Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1558195
MD5:	afd25f2fa473d794759a6e9f51c50d87
SHA1:	4f874fd536a0a8a0cf044ee47f25785a8a957c4d
SHA256:	473ab5b030273598bc64ab38aafdc6666239c7aa63682f3ef44ffd9dec83b576
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7920 cmdline: "C:\Users\user\Desktop\file.exe" MD5: AFD25F2FA473D794759A6E9F51C50D87)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["3xp3cts1aim.sbs", "p3ar11fter.sbs", "processhol.sbs", "p10tgrace.sbs", "peepburry828.sbs"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:31:09.050426+0100	2028371	3	Unknown Traffic	192.168.2.10	49722	188.114.96.3	443	TCP
2024-11-19T06:31:47.957664+0100	2028371	3	Unknown Traffic	192.168.2.10	49702	188.114.96.3	443	TCP
2024-11-19T06:31:59.956867+0100	2028371	3	Unknown Traffic	192.168.2.10	49709	188.114.96.3	443	TCP
2024-11-19T06:32:03.957350+0100	2028371	3	Unknown Traffic	192.168.2.10	49716	104.21.85.146	443	TCP
2024-11-19T06:32:07.957028+0100	2028371	3	Unknown Traffic	192.168.2.10	49717	188.114.97.3	443	TCP
2024-11-19T06:32:11.957031+0100	2028371	3	Unknown Traffic	192.168.2.10	49718	172.67.150.203	443	TCP
2024-11-19T06:32:15.968896+0100	2028371	3	Unknown Traffic	192.168.2.10	49719	188.114.97.3	443	TCP
2024-11-19T06:32:19.957034+0100	2028371	3	Unknown Traffic	192.168.2.10	49721	172.67.191.18	443	TCP

ET MALWARE Observed DNS Query to Lumma Stealer Domain (3xp3cts1aim .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:32:19.959844+0100	2057695	1	A Network Trojan was detected	192.168.2.10	51980	1.1.1.1	53	UDP

ET MALWARE Observed DNS Query to Lumma Stealer Domain (peepburry828 .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:32:11.958928+0100	2057696	1	A Network Trojan was detected	192.168.2.10	63118	1.1.1.1	53	UDP

ET MALWARE Observed DNS Query to Lumma Stealer Domain (processhol .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:31:47.961546+0100	2057697	1	A Network Trojan was detected	192.168.2.10	53151	1.1.1.1	53	UDP

ET MALWARE Observed Lumma Stealer Domain (3xp3cts1aim .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:31:09.050426+0100	2057699	1	A Network Trojan was detected	192.168.2.10	49728	188.114.96.3	443	TCP
2024-11-19T06:31:09.050426+0100	2057699	1	A Network Trojan was detected	192.168.2.10	49722	188.114.96.3	443	TCP

ET MALWARE Observed Lumma Stealer Domain (peepburry828 .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:32:15.968896+0100	2057700	1	A Network Trojan was detected	192.168.2.10	49719	188.114.97.3	443	TCP

ET MALWARE Observed Lumma Stealer Domain (processhol .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:31:59.956867+0100	2057701	1	A Network Trojan was detected	192.168.2.10	49709	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (3xp3cts1aim .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:31:09.050426+0100	2057653	1	Domain Observed Used for C2 Detected	192.168.2.10	49728	188.114.96.3	443	TCP
2024-11-19T06:31:09.050426+0100	2057653	1	Domain Observed Used for C2 Detected	192.168.2.10	49722	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (befall-sm0ker .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:32:07.957028+0100	2057655	1	Domain Observed Used for C2 Detected	192.168.2.10	49717	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:32:03.957350+0100	2057659	1	Domain Observed Used for C2 Detected	192.168.2.10	49716	104.21.85.146	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (owner-vacat10n .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:32:19.957034+0100	2057661	1	Domain Observed Used for C2 Detected	192.168.2.10	49721	172.67.191.18	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (p10tgrace .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:32:11.957031+0100	2057663	1	Domain Observed Used for C2 Detected	192.168.2.10	49718	172.67.150.203	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (peepburry828 .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:32:15.968896+0100	2057667	1	Domain Observed Used for C2 Detected	192.168.2.10	49719	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (processhol .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:31:59.956867+0100	2057669	1	Domain Observed Used for C2 Detected	192.168.2.10	49709	188.114.96.3	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (3xp3cts1aim .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:32:19.959844+0100	2057652	1	Domain Observed Used for C2 Detected	192.168.2.10	51980	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (befall-sm0ker .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:32:03.961542+0100	2057654	1	Domain Observed Used for C2 Detected	192.168.2.10	51216	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (librari-night .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:31:59.958471+0100	2057658	1	Domain Observed Used for C2 Detected	192.168.2.10	60902	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (owner-vacat10n .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:32:15.971883+0100	2057660	1	Domain Observed Used for C2 Detected	192.168.2.10	58020	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (p10tgrace .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:32:07.960537+0100	2057662	1	Domain Observed Used for C2 Detected	192.168.2.10	55757	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (peepburry828 .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:32:11.958928+0100	2057666	1	Domain Observed Used for C2 Detected	192.168.2.10	63118	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (processhol .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T06:31:47.961546+0100	2057668	1	Domain Observed Used for C2 Detected	192.168.2.10	53151	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://peepburry828.sbs/api	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs:443/apibuH	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/xzw	Avira URL Cloud: Label: malware
Source: https://peepburry828.sbs:443/api	Avira URL Cloud: Label: malware
Source: https://owner-vacat10n.sbs/ilx	Avira URL Cloud: Label: malware
Source: https://librari-night.sbs:443/api	Avira URL Cloud: Label: malware
Source: https://owner-vacat10n.sbs/api9	Avira URL Cloud: Label: malware
Source: https://librari-night.sbs/api	Avira URL Cloud: Label: malware
Source: https://befall-sm0ker.sbs/api	Avira URL Cloud: Label: malware
Source: https://befall-sm0ker.sbs:443/api	Avira URL Cloud: Label: malware
Source: https://befall-sm0ker.sbs/	Avira URL Cloud: Label: malware
Source: https://owner-vacat10n.sbs:443/api	Avira URL Cloud: Label: malware
Source: https://processhol.sbs:443/apiCu	Avira URL Cloud: Label: malware

Found malware configuration

Source: file.exe.7920.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["3xp3cts1aim.sbs", "p3ar11fter.sbs", "processhol.sbs", "p10tgrace.sbs", "peepburry828.sbs"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for domain / URL

Source: https://peepburry828.sbs:443/api	Virustotal: Detection: 15%			Perma Link
Source: https://peepburry828.sbs/api	Virustotal: Detection: 15%			Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 41%			Perma Link
Source: file.exe	ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: p3ar11fter.sbs
Source: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 3xp3cts1aim.sbs
Source: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: peepburry828.sbs
Source: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: p10tgrace.sbs
Source: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: processhol.sbs
Source: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-05h]	0_2_00F6BDB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-532F9054h]	0_2_00F6A874
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+edi+00000090h]	0_2_00F63060
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx]	0_2_00F84800
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	0_2_00FA1160
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, dword ptr [ecx+esi*4-000009BCh]	0_2_00F69150
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+000011E4h]	0_2_00F85150
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00F78940
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edx+4B5D9729h]	0_2_00F6CA6A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, word ptr [edi+ecx*4]	0_2_00F67BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+34h]	0_2_00F67BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_00F67BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [eax], bl	0_2_00F6CEF5
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov esi, edx	0_2_00F87E50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-69h]	0_2_00F87E50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [esp+esi+04h]	0_2_00F9BFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_00F61F50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 1B6183F2h	0_2_00F9BF10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057662 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (p10tgrace .sbs) : 192.168.2.10:55757 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057659 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI) : 192.168.2.10:49716 -> 104.21.85.146:443
Source: Network traffic	Suricata IDS: 2057654 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (befall-sm0ker .sbs) : 192.168.2.10:51216 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057658 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (librari-night .sbs) : 192.168.2.10:60902 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057661 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (owner-vacat10n .sbs in TLS SNI) : 192.168.2.10:49721 -> 172.67.191.18:443
Source: Network traffic	Suricata IDS: 2057663 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (p10tgrace .sbs in TLS SNI) : 192.168.2.10:49718 -> 172.67.150.203:443
Source: Network traffic	Suricata IDS: 2057668 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (processhol .sbs) : 192.168.2.10:53151 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057697 - Severity 1 - ET MALWARE Observed DNS Query to Lumma Stealer Domain (processhol .sbs) : 192.168.2.10:53151 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057660 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (owner-vacat10n .sbs) : 192.168.2.10:58020 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057666 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (peepburry828 .sbs) : 192.168.2.10:63118 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057667 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (peepburry828 .sbs in TLS SNI) : 192.168.2.10:49719 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057700 - Severity 1 - ET MALWARE Observed Lumma Stealer Domain (peepburry828 .sbs in TLS SNI) : 192.168.2.10:49719 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057669 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (processhol .sbs in TLS SNI) : 192.168.2.10:49709 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057701 - Severity 1 - ET MALWARE Observed Lumma Stealer Domain (processhol .sbs in TLS SNI) : 192.168.2.10:49709 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057696 - Severity 1 - ET MALWARE Observed DNS Query to Lumma Stealer Domain (peepburry828 .sbs) : 192.168.2.10:63118 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057652 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (3xp3cts1aim .sbs) : 192.168.2.10:51980 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057655 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (befall-sm0ker .sbs in TLS SNI) : 192.168.2.10:49717 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057695 - Severity 1 - ET MALWARE Observed DNS Query to Lumma Stealer Domain (3xp3cts1aim .sbs) : 192.168.2.10:51980 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057653 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (3xp3cts1aim .sbs in TLS SNI) : 192.168.2.10:49728 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057699 - Severity 1 - ET MALWARE Observed Lumma Stealer Domain (3xp3cts1aim .sbs in TLS SNI) : 192.168.2.10:49728 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057653 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (3xp3cts1aim .sbs in TLS SNI) : 192.168.2.10:49722 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057699 - Severity 1 - ET MALWARE Observed Lumma Stealer Domain (3xp3cts1aim .sbs in TLS SNI) : 192.168.2.10:49722 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: peepburry828.sbs

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49702 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49716 -> 104.21.85.146:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49721 -> 172.67.191.18:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49718 -> 172.67.150.203:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49719 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49709 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49717 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49722 -> 188.114.96.3:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: processhol.sbs
Source: global traffic	DNS traffic detected: DNS query: librari-night.sbs
Source: global traffic	DNS traffic detected: DNS query: befall-sm0ker.sbs
Source: global traffic	DNS traffic detected: DNS query: p10tgrace.sbs
Source: global traffic	DNS traffic detected: DNS query: peepburry828.sbs
Source: global traffic	DNS traffic detected: DNS query: owner-vacat10n.sbs
Source: global traffic	DNS traffic detected: DNS query: 3xp3cts1aim.sbs

Source: file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://3xp3cts1aim.sbs/
Source: file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://3xp3cts1aim.sbs/al
Source: file.exe, 00000000.00000002.3787332249.0000000000A6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://3xp3cts1aim.sbs/api
Source: file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://3xp3cts1aim.sbs/apipi
Source: file.exe, 00000000.00000002.3787332249.0000000000A6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://3xp3cts1aim.sbs/apis
Source: file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://3xp3cts1aim.sbs/pi
Source: file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://3xp3cts1aim.sbs:443/api(v
Source: file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://befall-sm0ker.sbs/
Source: file.exe, 00000000.00000002.3787332249.0000000000A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://befall-sm0ker.sbs/api
Source: file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://befall-sm0ker.sbs:443/api
Source: file.exe, 00000000.00000002.3787332249.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/xzw
Source: file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/apibuH
Source: file.exe, 00000000.00000002.3787332249.0000000000A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://librari-night.sbs/api
Source: file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://librari-night.sbs:443/api
Source: file.exe, 00000000.00000002.3787332249.0000000000A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://owner-vacat10n.sbs/api9
Source: file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://owner-vacat10n.sbs/ilx
Source: file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://owner-vacat10n.sbs:443/api
Source: file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peepburry828.sbs/
Source: file.exe, 00000000.00000002.3787332249.0000000000A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peepburry828.sbs/api
Source: file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peepburry828.sbs:443/api
Source: file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://processhol.sbs:443/apiCu

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F68F20	0_2_00F68F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F670A0	0_2_00F670A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA00A0	0_2_00FA00A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F66090	0_2_00F66090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7F090	0_2_00F7F090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F63060	0_2_00F63060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F84800	0_2_00F84800
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01129052	0_2_01129052
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F98970	0_2_00F98970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8F960	0_2_00F8F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F69150	0_2_00F69150
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F69940	0_2_00F69940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011240D8	0_2_011240D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FECAD4	0_2_00FECAD4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F63A60	0_2_00F63A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0112FB8C	0_2_0112FB8C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0112ABB1	0_2_0112ABB1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01125BAA	0_2_01125BAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6B220	0_2_00F6B220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8A3F0	0_2_00F8A3F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0105EA3C	0_2_0105EA3C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F67BB0	0_2_00F67BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F82BA0	0_2_00F82BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F9BB70	0_2_00F9BB70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F9FB70	0_2_00F9FB70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0112328F	0_2_0112328F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F99310	0_2_00F99310
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010912E4	0_2_010912E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F80CD0	0_2_00F80CD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F62CC0	0_2_00F62CC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6DCB7	0_2_00F6DCB7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0109956E	0_2_0109956E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7FC80	0_2_00F7FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0112C59E	0_2_0112C59E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F64440	0_2_00F64440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F66C10	0_2_00F66C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6ADE0	0_2_00F6ADE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01120C3C	0_2_01120C3C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F69DC0	0_2_00F69DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA15B0	0_2_00FA15B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01000C54	0_2_01000C54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F66550	0_2_00F66550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6CEF5	0_2_00F6CEF5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6B6E0	0_2_00F6B6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F84EE0	0_2_00F84EE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F80EA0	0_2_00F80EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01068776	0_2_01068776
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01049798	0_2_01049798
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F87E50	0_2_00F87E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F9FFD0	0_2_00F9FFD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0112762C	0_2_0112762C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F64F8F	0_2_00F64F8F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F98710	0_2_00F98710

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9974280631188119
Source: file.exe	Static PE information: Section: wrtbandm ZLIB complexity 0.9942020553885291

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@8/5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F8F960 CoCreateInstance,

0_2_00F8F960

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	Virustotal: Detection: 41%
Source: file.exe	ReversingLabs: Detection: 39%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static file information: File size 1830400 > 1048576

Source: file.exe

Static PE information: Raw size of wrtbandm is bigger than: 0x100000 < 0x195600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.f60000.0.unpack :EW;.rsrc :W;.idata :W; :EW;wrtbandm:EW;cneunvgm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;wrtbandm:EW;cneunvgm:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cb056 should be: 0x1c1367

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: wrtbandm
Source: file.exe	Static PE information: section name: cneunvgm
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010DF90D push ecx; mov dword ptr [esp], edx	0_2_010DF91E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010DF90D push edx; mov dword ptr [esp], 6FE6EAB2h	0_2_010DF922
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010DF90D push ebx; mov dword ptr [esp], 7BD7C5C5h	0_2_010DF961
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118A114 push 563610E6h; mov dword ptr [esp], ebx	0_2_0118A136
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118A114 push ecx; mov dword ptr [esp], esp	0_2_0118A13A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118A114 push edi; mov dword ptr [esp], ebp	0_2_0118A1AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118A114 push ebx; mov dword ptr [esp], 0CCE0D81h	0_2_0118A245
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118A114 push ecx; mov dword ptr [esp], ebp	0_2_0118A281
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118A114 push 3060D63Dh; mov dword ptr [esp], edi	0_2_0118A2C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118A114 push eax; mov dword ptr [esp], edx	0_2_0118A2CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011F3112 push ebp; mov dword ptr [esp], esi	0_2_011F3137
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E7156 push 453C51AFh; mov dword ptr [esp], ecx	0_2_011E717E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C914C push edx; mov dword ptr [esp], 3EFF4399h	0_2_011C916D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011BD9B4 push eax; mov dword ptr [esp], edi	0_2_011BDA61
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011BD9B4 push edi; mov dword ptr [esp], 6F8F2F56h	0_2_011BDA7E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011BD9B4 push esi; mov dword ptr [esp], eax	0_2_011BDAA6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013EA18E push eax; mov dword ptr [esp], 78779C58h	0_2_013EA1A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013EA18E push 5F59E7DAh; mov dword ptr [esp], ebp	0_2_013EA1C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013EA18E push 4514AFDEh; mov dword ptr [esp], ecx	0_2_013EA29B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011A89D9 push eax; mov dword ptr [esp], ecx	0_2_011A8A32
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012121D9 push edx; mov dword ptr [esp], eax	0_2_01212135
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118C823 push 3B3AFAF7h; mov dword ptr [esp], ebp	0_2_0118C82B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118C823 push 68A15B7Eh; mov dword ptr [esp], eax	0_2_0118C880
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118C823 push 7B37B7E5h; mov dword ptr [esp], ecx	0_2_0118C9B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01129052 push edx; mov dword ptr [esp], edi	0_2_011291B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01129052 push 5233DF31h; mov dword ptr [esp], eax	0_2_01129223
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01129052 push ebp; mov dword ptr [esp], 000639BEh	0_2_0112928C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01129052 push edx; mov dword ptr [esp], edi	0_2_01129316
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01129052 push esi; mov dword ptr [esp], eax	0_2_0112937F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01129052 push 56DE14A8h; mov dword ptr [esp], esi	0_2_011293AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01129052 push edi; mov dword ptr [esp], eax	0_2_01129418

Source: file.exe	Static PE information: section name: entropy: 7.981310490186909
Source: file.exe	Static PE information: section name: wrtbandm entropy: 7.952710850398654

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC1B9 second address: FBBA7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 ja 00007FA97CE76BBDh 0x0000000f push dword ptr [ebp+122D006Dh] 0x00000015 sub dword ptr [ebp+122D1BCDh], eax 0x0000001b call dword ptr [ebp+122D2ECBh] 0x00000021 pushad 0x00000022 jc 00007FA97CE76BC0h 0x00000028 xor eax, eax 0x0000002a xor dword ptr [ebp+122D360Ah], ecx 0x00000030 mov edx, dword ptr [esp+28h] 0x00000034 jc 00007FA97CE76BC2h 0x0000003a jnp 00007FA97CE76BBCh 0x00000040 mov dword ptr [ebp+122D2AD0h], eax 0x00000046 sub dword ptr [ebp+122D36C2h], esi 0x0000004c mov esi, 0000003Ch 0x00000051 jp 00007FA97CE76BCFh 0x00000057 add esi, dword ptr [esp+24h] 0x0000005b cld 0x0000005c lodsw 0x0000005e stc 0x0000005f mov dword ptr [ebp+122D36C2h], ecx 0x00000065 add eax, dword ptr [esp+24h] 0x00000069 jmp 00007FA97CE76BC3h 0x0000006e mov ebx, dword ptr [esp+24h] 0x00000072 clc 0x00000073 push eax 0x00000074 push eax 0x00000075 push edx 0x00000076 js 00007FA97CE76BC5h 0x0000007c jmp 00007FA97CE76BBFh 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1133774 second address: 1133778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1133778 second address: 113378A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CE76BBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1133D14 second address: 1133D3E instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA97CDB0706h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop ecx 0x0000000e jmp 00007FA97CDB0712h 0x00000013 popad 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 jc 00007FA97CDB0706h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1133D3E second address: 1133D44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1133EAF second address: 1133EBA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 js 00007FA97CDB0706h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1133EBA second address: 1133EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136795 second address: FBBA7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 xor dword ptr [esp], 7E941363h 0x0000000c mov edx, dword ptr [ebp+122D2D34h] 0x00000012 push dword ptr [ebp+122D006Dh] 0x00000018 mov esi, dword ptr [ebp+122D2C2Ch] 0x0000001e call dword ptr [ebp+122D2ECBh] 0x00000024 pushad 0x00000025 jc 00007FA97CDB0710h 0x0000002b pushad 0x0000002c movzx edi, cx 0x0000002f mov edx, 1ACC7ECAh 0x00000034 popad 0x00000035 xor eax, eax 0x00000037 xor dword ptr [ebp+122D360Ah], ecx 0x0000003d mov edx, dword ptr [esp+28h] 0x00000041 jc 00007FA97CDB0712h 0x00000047 jnp 00007FA97CDB070Ch 0x0000004d mov dword ptr [ebp+122D1BCDh], ecx 0x00000053 mov dword ptr [ebp+122D2AD0h], eax 0x00000059 sub dword ptr [ebp+122D36C2h], esi 0x0000005f mov esi, 0000003Ch 0x00000064 jp 00007FA97CDB071Fh 0x0000006a jmp 00007FA97CDB0719h 0x0000006f add esi, dword ptr [esp+24h] 0x00000073 cld 0x00000074 lodsw 0x00000076 stc 0x00000077 mov dword ptr [ebp+122D36C2h], ecx 0x0000007d add eax, dword ptr [esp+24h] 0x00000081 jmp 00007FA97CDB0713h 0x00000086 mov ebx, dword ptr [esp+24h] 0x0000008a clc 0x0000008b push eax 0x0000008c push eax 0x0000008d push edx 0x0000008e js 00007FA97CDB0715h 0x00000094 jmp 00007FA97CDB070Fh 0x00000099 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11367DE second address: 1136897 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CE76BC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b sub dword ptr [ebp+122D2218h], edx 0x00000011 push 00000000h 0x00000013 mov ecx, 6DA028E0h 0x00000018 push 5FC11056h 0x0000001d jmp 00007FA97CE76BC2h 0x00000022 xor dword ptr [esp], 5FC110D6h 0x00000029 jo 00007FA97CE76BB7h 0x0000002f cmc 0x00000030 push 00000003h 0x00000032 pushad 0x00000033 mov ax, 89BAh 0x00000037 mov dword ptr [ebp+122D36C2h], edi 0x0000003d popad 0x0000003e push 00000000h 0x00000040 mov ecx, esi 0x00000042 push 00000003h 0x00000044 mov cl, F0h 0x00000046 call 00007FA97CE76BB9h 0x0000004b jmp 00007FA97CE76BBFh 0x00000050 push eax 0x00000051 jns 00007FA97CE76BC4h 0x00000057 mov eax, dword ptr [esp+04h] 0x0000005b pushad 0x0000005c push edi 0x0000005d pushad 0x0000005e popad 0x0000005f pop edi 0x00000060 push eax 0x00000061 push eax 0x00000062 pop eax 0x00000063 pop eax 0x00000064 popad 0x00000065 mov eax, dword ptr [eax] 0x00000067 push edi 0x00000068 push ecx 0x00000069 push edx 0x0000006a pop edx 0x0000006b pop ecx 0x0000006c pop edi 0x0000006d mov dword ptr [esp+04h], eax 0x00000071 push eax 0x00000072 push edx 0x00000073 jmp 00007FA97CE76BBAh 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136897 second address: 11368EE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA97CDB070Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov dword ptr [ebp+122D3362h], edx 0x00000011 lea ebx, dword ptr [ebp+1244E6E6h] 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007FA97CDB0708h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D2EDDh], esi 0x00000037 push eax 0x00000038 pushad 0x00000039 push eax 0x0000003a push esi 0x0000003b pop esi 0x0000003c pop eax 0x0000003d pushad 0x0000003e ja 00007FA97CDB0706h 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136930 second address: 11369D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], eax 0x00000008 jno 00007FA97CE76BBEh 0x0000000e or esi, dword ptr [ebp+122D2B6Ch] 0x00000014 push 00000000h 0x00000016 call 00007FA97CE76BC8h 0x0000001b mov edx, dword ptr [ebp+122D2B58h] 0x00000021 pop edx 0x00000022 push 17C75AC3h 0x00000027 pushad 0x00000028 jmp 00007FA97CE76BBFh 0x0000002d push edx 0x0000002e push edx 0x0000002f pop edx 0x00000030 pop edx 0x00000031 popad 0x00000032 xor dword ptr [esp], 17C75A43h 0x00000039 clc 0x0000003a jne 00007FA97CE76BBCh 0x00000040 push 00000003h 0x00000042 mov di, si 0x00000045 push 00000000h 0x00000047 and si, F2C4h 0x0000004c push 00000003h 0x0000004e jmp 00007FA97CE76BC6h 0x00000053 call 00007FA97CE76BBAh 0x00000058 mov esi, eax 0x0000005a pop edx 0x0000005b push A97A9924h 0x00000060 push edi 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11369D5 second address: 1136A1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CDB070Eh 0x00000009 popad 0x0000000a pop edi 0x0000000b xor dword ptr [esp], 697A9924h 0x00000012 mov edi, edx 0x00000014 lea ebx, dword ptr [ebp+1244E6EFh] 0x0000001a sub dl, FFFFFFA1h 0x0000001d push eax 0x0000001e pushad 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FA97CDB0719h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136AC4 second address: 1136AC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136BBE second address: 1136C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FA97CDB0718h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jns 00007FA97CDB0719h 0x00000018 pushad 0x00000019 jmp 00007FA97CDB070Fh 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 mov eax, dword ptr [eax] 0x00000023 jmp 00007FA97CDB070Dh 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136C14 second address: 1136C26 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA97CE76BB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FA97CE76BB6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157FF6 second address: 1157FFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157FFA second address: 1157FFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157FFE second address: 1158004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1158004 second address: 115800A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115800A second address: 1158014 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FA97CDB0706h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1158014 second address: 115802C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CE76BC4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155E1A second address: 1155E1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155FAC second address: 1155FB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155FB2 second address: 1155FC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CDB0710h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155FC6 second address: 1155FDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FA97CE76BB8h 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155FDB second address: 1155FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CDB0716h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155FF5 second address: 1155FF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115629C second address: 11562A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11562A0 second address: 11562B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FA97CE76BC2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11563BC second address: 11563DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA97CDB0706h 0x0000000a jmp 00007FA97CDB0718h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11563DF second address: 1156409 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CE76BC0h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA97CE76BC4h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156409 second address: 115640D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115640D second address: 1156411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156411 second address: 1156417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115656D second address: 1156573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156F89 second address: 1156F8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156F8D second address: 1156F91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157115 second address: 1157143 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA97CDB0706h 0x00000008 jmp 00007FA97CDB0719h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jnc 00007FA97CDB0706h 0x00000016 push edi 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157143 second address: 115714C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11576E0 second address: 11576EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11576EC second address: 1157711 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FA97CE76BCFh 0x0000000c jmp 00007FA97CE76BC9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157711 second address: 1157727 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA97CDB070Bh 0x00000008 jc 00007FA97CDB0706h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157883 second address: 1157889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157A37 second address: 1157A41 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA97CDB0706h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157A41 second address: 1157A5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 jl 00007FA97CE76BB6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128C18 second address: 1128C1E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115DF94 second address: 115DF98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116293E second address: 1162942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162C0D second address: 1162C13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162EE7 second address: 1162F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA97CDB0719h 0x0000000a push ebx 0x0000000b jl 00007FA97CDB0706h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1163E86 second address: 1163E8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1164067 second address: 1164075 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CDB070Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1164942 second address: 116494C instructions: 0x00000000 rdtsc 0x00000002 je 00007FA97CE76BBCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1164FAA second address: 1164FAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1164FAE second address: 1164FB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1164FB2 second address: 1164FD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA97CDB070Fh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jc 00007FA97CDB0706h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1164FD3 second address: 1165009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007FA97CE76BB8h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 0000001Ah 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 push 00000000h 0x00000023 movsx edi, di 0x00000026 push 00000000h 0x00000028 xchg eax, ebx 0x00000029 push ecx 0x0000002a push eax 0x0000002b push edx 0x0000002c push ecx 0x0000002d pop ecx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116597A second address: 1165981 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11657FA second address: 11657FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11657FE second address: 1165804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11674DA second address: 11674DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11674DE second address: 11674E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11674E2 second address: 11674F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jo 00007FA97CE76BBCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11687FB second address: 1168801 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C88B second address: 116C88F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1168801 second address: 1168806 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C88F second address: 116C8AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b jmp 00007FA97CE76BC0h 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C8AB second address: 116C8B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C8B1 second address: 116C8B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EE2E second address: 116EE72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FA97CDB0706h 0x00000009 jmp 00007FA97CDB0718h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 ja 00007FA97CDB070Ch 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e mov dword ptr [ebp+122D1F05h], edi 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116E06A second address: 116E077 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EE72 second address: 116EE76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EE76 second address: 116EE7C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116E077 second address: 116E11A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CDB070Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a nop 0x0000000b push dword ptr fs:[00000000h] 0x00000012 xor bx, 436Dh 0x00000017 mov dword ptr fs:[00000000h], esp 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007FA97CDB0708h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 0000001Ch 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 mov di, 3361h 0x0000003c mov eax, dword ptr [ebp+122D0EE1h] 0x00000042 movzx ebx, di 0x00000045 push FFFFFFFFh 0x00000047 push 00000000h 0x00000049 push eax 0x0000004a call 00007FA97CDB0708h 0x0000004f pop eax 0x00000050 mov dword ptr [esp+04h], eax 0x00000054 add dword ptr [esp+04h], 00000018h 0x0000005c inc eax 0x0000005d push eax 0x0000005e ret 0x0000005f pop eax 0x00000060 ret 0x00000061 pushad 0x00000062 jmp 00007FA97CDB0718h 0x00000067 mov dword ptr [ebp+122D3512h], esi 0x0000006d popad 0x0000006e mov di, 14EEh 0x00000072 nop 0x00000073 push eax 0x00000074 push edx 0x00000075 push eax 0x00000076 push edx 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116E11A second address: 116E11E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116E11E second address: 116E128 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA97CDB0706h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F0D6 second address: 116F0DC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170E04 second address: 1170E5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CDB0715h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edi, dword ptr [ebp+122D2C7Ch] 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FA97CDB070Eh 0x0000001b mov bx, ax 0x0000001e pop edi 0x0000001f pop ebx 0x00000020 push 00000000h 0x00000022 add bx, 544Bh 0x00000027 xchg eax, esi 0x00000028 push ecx 0x00000029 jbe 00007FA97CDB0708h 0x0000002f push ebx 0x00000030 pop ebx 0x00000031 pop ecx 0x00000032 push eax 0x00000033 pushad 0x00000034 jp 00007FA97CDB0708h 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170073 second address: 117009F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FA97CE76BBDh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA97CE76BC6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172D02 second address: 1172D06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117344E second address: 1173458 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FA97CE76BB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117357E second address: 1173590 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CDB070Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11768D6 second address: 11768DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117871F second address: 11787A3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA97CDB0706h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e sub dword ptr [ebp+122D3141h], eax 0x00000014 push 00000000h 0x00000016 mov edi, dword ptr [ebp+122D3110h] 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007FA97CDB0708h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 00000017h 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 xchg eax, esi 0x00000039 pushad 0x0000003a pushad 0x0000003b jl 00007FA97CDB0706h 0x00000041 jmp 00007FA97CDB0718h 0x00000046 popad 0x00000047 jmp 00007FA97CDB070Ch 0x0000004c popad 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 jns 00007FA97CDB0715h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117A93A second address: 117A940 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117A940 second address: 117A9DD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007FA97CDB0708h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a call 00007FA97CDB0708h 0x0000002f pop ecx 0x00000030 mov dword ptr [esp+04h], ecx 0x00000034 add dword ptr [esp+04h], 0000001Dh 0x0000003c inc ecx 0x0000003d push ecx 0x0000003e ret 0x0000003f pop ecx 0x00000040 ret 0x00000041 cld 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push edi 0x00000047 call 00007FA97CDB0708h 0x0000004c pop edi 0x0000004d mov dword ptr [esp+04h], edi 0x00000051 add dword ptr [esp+04h], 0000001Bh 0x00000059 inc edi 0x0000005a push edi 0x0000005b ret 0x0000005c pop edi 0x0000005d ret 0x0000005e sub bx, 69EBh 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 jl 00007FA97CDB0718h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117AB85 second address: 117AC1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CE76BC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D1BCDh], edi 0x00000011 push dword ptr fs:[00000000h] 0x00000018 and di, 7C13h 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 push 00000000h 0x00000026 push esi 0x00000027 call 00007FA97CE76BB8h 0x0000002c pop esi 0x0000002d mov dword ptr [esp+04h], esi 0x00000031 add dword ptr [esp+04h], 00000018h 0x00000039 inc esi 0x0000003a push esi 0x0000003b ret 0x0000003c pop esi 0x0000003d ret 0x0000003e add ebx, dword ptr [ebp+122D2B00h] 0x00000044 mov ebx, dword ptr [ebp+122D2D64h] 0x0000004a mov eax, dword ptr [ebp+122D07E1h] 0x00000050 push edx 0x00000051 jnl 00007FA97CE76BB8h 0x00000057 pop edi 0x00000058 push FFFFFFFFh 0x0000005a call 00007FA97CE76BC9h 0x0000005f mov ebx, 435863D1h 0x00000064 pop edi 0x00000065 nop 0x00000066 push eax 0x00000067 push edx 0x00000068 ja 00007FA97CE76BB8h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BA4E second address: 117BA58 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA97CDB0706h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117CAA9 second address: 117CB31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CE76BC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b call 00007FA97CE76BC9h 0x00000010 call 00007FA97CE76BC7h 0x00000015 pop edx 0x00000016 pop ecx 0x00000017 popad 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007FA97CE76BB8h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 00000019h 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 pushad 0x00000035 mov edi, dword ptr [ebp+122D2BA0h] 0x0000003b and ecx, dword ptr [ebp+122DB8F0h] 0x00000041 popad 0x00000042 push 00000000h 0x00000044 mov ebx, dword ptr [ebp+122D33C2h] 0x0000004a push eax 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BA58 second address: 117BA6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA97CDB070Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BB29 second address: 117BB41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CE76BC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BB41 second address: 117BB46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117ECBB second address: 117ECC0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182019 second address: 1182036 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FA97CDB0706h 0x0000000a jmp 00007FA97CDB0713h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182036 second address: 1182051 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA97CE76BBEh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182051 second address: 1182057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182057 second address: 118205D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118205D second address: 1182066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182066 second address: 118206A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118206A second address: 1182076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA97CDB0706h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11895B5 second address: 11895BA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11899BE second address: 11899DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CDB0718h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D998 second address: 118D99C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119104D second address: FBBA7C instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA97CDB0706h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b xor dword ptr [esp], 6370DCF4h 0x00000012 cld 0x00000013 push dword ptr [ebp+122D006Dh] 0x00000019 pushad 0x0000001a jmp 00007FA97CDB0714h 0x0000001f sub si, 245Bh 0x00000024 popad 0x00000025 jmp 00007FA97CDB0710h 0x0000002a call dword ptr [ebp+122D2ECBh] 0x00000030 pushad 0x00000031 jc 00007FA97CDB0710h 0x00000037 pushad 0x00000038 movzx edi, cx 0x0000003b mov edx, 1ACC7ECAh 0x00000040 popad 0x00000041 xor eax, eax 0x00000043 xor dword ptr [ebp+122D360Ah], ecx 0x00000049 mov edx, dword ptr [esp+28h] 0x0000004d jc 00007FA97CDB0712h 0x00000053 jnp 00007FA97CDB070Ch 0x00000059 mov dword ptr [ebp+122D1BCDh], ecx 0x0000005f mov dword ptr [ebp+122D2AD0h], eax 0x00000065 sub dword ptr [ebp+122D36C2h], esi 0x0000006b mov esi, 0000003Ch 0x00000070 jp 00007FA97CDB071Fh 0x00000076 add esi, dword ptr [esp+24h] 0x0000007a cld 0x0000007b lodsw 0x0000007d stc 0x0000007e mov dword ptr [ebp+122D36C2h], ecx 0x00000084 add eax, dword ptr [esp+24h] 0x00000088 jmp 00007FA97CDB0713h 0x0000008d mov ebx, dword ptr [esp+24h] 0x00000091 clc 0x00000092 push eax 0x00000093 push eax 0x00000094 push edx 0x00000095 js 00007FA97CDB0715h 0x0000009b jmp 00007FA97CDB070Fh 0x000000a0 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195DE7 second address: 1195DEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195DEE second address: 1195E1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA97CDB0719h 0x0000000c jmp 00007FA97CDB070Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196347 second address: 119635B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA97CE76BBDh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11964C0 second address: 11964CC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11964CC second address: 11964DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CE76BBDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11964DD second address: 1196511 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA97CDB0716h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007FA97CDB0706h 0x00000016 jmp 00007FA97CDB070Dh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11969A1 second address: 11969D1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA97CE76BB6h 0x00000008 jl 00007FA97CE76BB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 je 00007FA97CE76BD0h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11969D1 second address: 11969D6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11969D6 second address: 11969E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196C90 second address: 1196CB9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA97CDB0706h 0x00000008 jmp 00007FA97CDB0717h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jne 00007FA97CDB0706h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196E3C second address: 1196E40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196E40 second address: 1196E49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196FBD second address: 1196FE6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FA97CE76BC2h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA97CE76BBFh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D391 second address: 119D395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D395 second address: 119D3A5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA97CE76BB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D4E9 second address: 119D51E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FA97CDB0706h 0x00000009 push edx 0x0000000a pop edx 0x0000000b ja 00007FA97CDB0706h 0x00000011 popad 0x00000012 jo 00007FA97CDB071Dh 0x00000018 jc 00007FA97CDB0706h 0x0000001e jmp 00007FA97CDB0711h 0x00000023 pop edx 0x00000024 pop eax 0x00000025 push eax 0x00000026 push esi 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CF2D second address: 119CF37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DC82 second address: 119DC86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DF83 second address: 119DF89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DF89 second address: 119DF8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E21E second address: 119E249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jne 00007FA97CE76BB6h 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 ja 00007FA97CE76BCEh 0x00000017 jmp 00007FA97CE76BC2h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E249 second address: 119E258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA97CDB0708h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E258 second address: 119E264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA97CE76BB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4412 second address: 11A4418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3344 second address: 11A3352 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FA97CE76BBCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3352 second address: 11A336C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 jmp 00007FA97CDB0711h 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A336C second address: 11A337E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CE76BBDh 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A378E second address: 11A37A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA97CDB0706h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FA97CDB0706h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A37A1 second address: 11A37A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3A48 second address: 11A3A4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3A4C second address: 11A3A52 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3BDC second address: 11A3BEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CDB070Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3BEE second address: 11A3BF4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3BF4 second address: 11A3BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3D39 second address: 11A3D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D934 second address: 114D938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D938 second address: 114D93C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A2C85 second address: 11A2CAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jne 00007FA97CDB0706h 0x0000000b jmp 00007FA97CDB0714h 0x00000010 popad 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7ADB second address: 11A7ADF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7ADF second address: 11A7AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7AE8 second address: 11A7AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AFD8 second address: 116B00A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 add di, 1FA4h 0x0000000d pushad 0x0000000e or dword ptr [ebp+122D366Bh], edx 0x00000014 mov di, 829Eh 0x00000018 popad 0x00000019 lea eax, dword ptr [ebp+12482CADh] 0x0000001f mov dx, di 0x00000022 nop 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FA97CDB070Dh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B00A second address: 116B010 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B010 second address: 116B014 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B400 second address: FBBA7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CE76BBFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FA97CE76BC0h 0x0000000f nop 0x00000010 xor dword ptr [ebp+1244EC27h], ecx 0x00000016 mov ch, dh 0x00000018 push dword ptr [ebp+122D006Dh] 0x0000001e or dword ptr [ebp+122D20F2h], edx 0x00000024 call dword ptr [ebp+122D2ECBh] 0x0000002a pushad 0x0000002b jc 00007FA97CE76BC0h 0x00000031 pushad 0x00000032 movzx edi, cx 0x00000035 mov edx, 1ACC7ECAh 0x0000003a popad 0x0000003b xor eax, eax 0x0000003d xor dword ptr [ebp+122D360Ah], ecx 0x00000043 mov edx, dword ptr [esp+28h] 0x00000047 jc 00007FA97CE76BC2h 0x0000004d jnp 00007FA97CE76BBCh 0x00000053 mov dword ptr [ebp+122D2AD0h], eax 0x00000059 sub dword ptr [ebp+122D36C2h], esi 0x0000005f mov esi, 0000003Ch 0x00000064 jp 00007FA97CE76BCFh 0x0000006a add esi, dword ptr [esp+24h] 0x0000006e cld 0x0000006f lodsw 0x00000071 stc 0x00000072 mov dword ptr [ebp+122D36C2h], ecx 0x00000078 add eax, dword ptr [esp+24h] 0x0000007c jmp 00007FA97CE76BC3h 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 clc 0x00000086 push eax 0x00000087 push eax 0x00000088 push edx 0x00000089 js 00007FA97CE76BC5h 0x0000008f jmp 00007FA97CE76BBFh 0x00000094 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B834 second address: 116B850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA97CDB0718h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B850 second address: 116B887 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CE76BC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007FA97CE76BC6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B887 second address: 116B891 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FA97CDB0706h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B891 second address: 116B895 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B895 second address: 116B8AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push edx 0x0000000d push eax 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop eax 0x00000011 pop edx 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pushad 0x00000018 popad 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BE2D second address: 116BE31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BE31 second address: 116BEB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FA97CDB0708h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 jmp 00007FA97CDB0716h 0x00000029 push 0000001Eh 0x0000002b push 00000000h 0x0000002d push ecx 0x0000002e call 00007FA97CDB0708h 0x00000033 pop ecx 0x00000034 mov dword ptr [esp+04h], ecx 0x00000038 add dword ptr [esp+04h], 0000001Dh 0x00000040 inc ecx 0x00000041 push ecx 0x00000042 ret 0x00000043 pop ecx 0x00000044 ret 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007FA97CDB0718h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BEB3 second address: 116BEB8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8162 second address: 11A8168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8168 second address: 11A8174 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8174 second address: 11A818A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FA97CDB0706h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A818A second address: 11A818E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8463 second address: 11A8497 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CDB0718h 0x00000007 jmp 00007FA97CDB0712h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 popad 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8497 second address: 11A849F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A849F second address: 11A84A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA310 second address: 11AA329 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FA97CE76BC1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B26B9 second address: 11B26BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B26BD second address: 11B26C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B8B5D second address: 11B8B63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B8B63 second address: 11B8B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B8B69 second address: 11B8B89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FA97CDB0715h 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B8426 second address: 11B8438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CE76BBEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B8438 second address: 11B8453 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a jno 00007FA97CDB070Ah 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 push eax 0x00000019 pop eax 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B88A2 second address: 11B88B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CE76BBFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B88B5 second address: 11B88C7 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA97CDB070Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BC885 second address: 11BC896 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jl 00007FA97CE76BB6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop edx 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCB23 second address: 11BCB45 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FA97CDB0718h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCB45 second address: 11BCB49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCB49 second address: 11BCB4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCD25 second address: 11BCD29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCE7E second address: 11BCEAA instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA97CDB0706h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007FA97CDB071Dh 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BCF5 second address: 116BCFB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BDC40 second address: 11BDC44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2797 second address: 11C27A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C27A0 second address: 11C27A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1AB0 second address: 11C1ABD instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA97CE76BB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1D6F second address: 11C1D75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1D75 second address: 11C1D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1D79 second address: 11C1D9F instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA97CDB0706h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnp 00007FA97CDB0706h 0x00000013 jmp 00007FA97CDB0711h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2052 second address: 11C205B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C22DD second address: 11C22E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C22E1 second address: 11C22E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C22E7 second address: 11C22F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7649 second address: 11C7661 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FA97CE76BBAh 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d ja 00007FA97CE76BB6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7661 second address: 11C7695 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CDB0713h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e pushad 0x0000000f jmp 00007FA97CDB0711h 0x00000014 push eax 0x00000015 pop eax 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C79BA second address: 11C79CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CE76BBEh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C79CE second address: 11C79DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C79DB second address: 11C79E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FA97CE76BB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C79E7 second address: 11C79EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C79EB second address: 11C79FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CE76BBBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C79FA second address: 11C7A23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 pushad 0x00000012 jmp 00007FA97CDB0715h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7A23 second address: 11C7A33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FA97CE76BB6h 0x0000000a popad 0x0000000b push ecx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE20F second address: 11CE22E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CDB0719h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD7AC second address: 11CD7B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FA97CE76BBCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDBE6 second address: 11CDBF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDBF0 second address: 11CDBF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDBF4 second address: 11CDC04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FA97CDB0706h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDF48 second address: 11CDF6A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA97CE76BB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FA97CE76BC4h 0x00000010 jmp 00007FA97CE76BBEh 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDF6A second address: 11CDF6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDF6E second address: 11CDF78 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA97CE76BB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D26AA second address: 11D26AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D26AE second address: 11D26B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D26B7 second address: 11D26CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CDB0713h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D26CF second address: 11D26D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D26D4 second address: 11D2710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CDB0717h 0x00000009 ja 00007FA97CDB0706h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FA97CDB070Dh 0x00000019 pushad 0x0000001a jg 00007FA97CDB0706h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2710 second address: 11D271B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA97CE76BB6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DB6F4 second address: 11DB736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CDB0718h 0x00000009 jc 00007FA97CDB0706h 0x0000000f ja 00007FA97CDB0706h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FA97CDB0711h 0x0000001d jo 00007FA97CDB0706h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D99C1 second address: 11D99D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CE76BBCh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9B10 second address: 11D9B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9B19 second address: 11D9B1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9B1F second address: 11D9B23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9D8E second address: 11D9D92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9D92 second address: 11D9D98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9EF3 second address: 11D9EF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9EF7 second address: 11D9F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA97CDB0706h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007FA97CDB071Eh 0x00000014 jg 00007FA97CDB0712h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9F35 second address: 11D9F56 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA97CE76BCCh 0x00000008 jmp 00007FA97CE76BC4h 0x0000000d push edi 0x0000000e pop edi 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DA463 second address: 11DA47D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CDB0716h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DA5FE second address: 11DA625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CE76BC0h 0x00000009 jmp 00007FA97CE76BC2h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DA625 second address: 11DA63F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA97CDB0716h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E08CD second address: 11E08FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 jo 00007FA97CE76BBAh 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 pop eax 0x00000013 jmp 00007FA97CE76BC2h 0x00000018 popad 0x00000019 jbe 00007FA97CE76BC8h 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E08FC second address: 11E0906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0A59 second address: 11E0A66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007FA97CE76BB6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0A66 second address: 11E0A6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0BE1 second address: 11E0C05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CE76BBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA97CE76BC0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4E77 second address: 11F4E7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F49A1 second address: 11F49A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F49A5 second address: 11F49A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F49A9 second address: 11F49B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F938C second address: 11F9399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FA97CDB0706h 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9399 second address: 11F93B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CE76BC1h 0x00000009 pop edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F93B2 second address: 11F93CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CDB0717h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F93CF second address: 11F93D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200A52 second address: 1200A65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CDB070Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200918 second address: 120091E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207858 second address: 1207862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FA97CDB0706h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207862 second address: 12078B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CE76BC9h 0x00000007 jmp 00007FA97CE76BC3h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop edx 0x00000012 jng 00007FA97CE76BC2h 0x00000018 popad 0x00000019 jg 00007FA97CE76BCEh 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 pop edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12078B7 second address: 12078C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FA97CDB0706h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207B87 second address: 1207BCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FA97CE76BC2h 0x0000000c jc 00007FA97CE76BB6h 0x00000012 ja 00007FA97CE76BB6h 0x00000018 pop eax 0x00000019 pushad 0x0000001a jmp 00007FA97CE76BC9h 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FA97CE76BC3h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207E98 second address: 1207EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CDB0712h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120801C second address: 1208021 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208A59 second address: 1208A5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208A5F second address: 1208A69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA97CE76BB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208A69 second address: 1208A6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208A6D second address: 1208A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120D2BF second address: 120D2DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CDB0716h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120D2DA second address: 120D2E4 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA97CE76BBCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120D2E4 second address: 120D301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FA97CDB0716h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120D301 second address: 120D309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120ECB6 second address: 120ECC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FA97CDB0706h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212002 second address: 1212010 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FA97CE76BC2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212010 second address: 1212016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121E5AF second address: 121E5BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 jbe 00007FA97CE76BBCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121E5BE second address: 121E5DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FA97CDB070Fh 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FA97CDB0706h 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121E5DD second address: 121E5E3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121E5E3 second address: 121E5F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CDB070Bh 0x00000007 jc 00007FA97CDB0712h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219767 second address: 1219781 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FA97CE76BC2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122C3F0 second address: 122C417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FA97CDB070Fh 0x00000011 popad 0x00000012 pop ebx 0x00000013 jng 00007FA97CDB0739h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122C417 second address: 122C432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CE76BC7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124170C second address: 1241712 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1241712 second address: 1241716 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240478 second address: 124047C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124047C second address: 12404A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CE76BC1h 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007FA97CE76BBFh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12404A3 second address: 12404A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240615 second address: 1240619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240619 second address: 1240638 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CDB0719h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240638 second address: 1240648 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 js 00007FA97CE76BB6h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240648 second address: 124064C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240AA9 second address: 1240AAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240AAD second address: 1240ACE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jg 00007FA97CDB0706h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA97CDB0713h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240ACE second address: 1240AD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240F55 second address: 1240F5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12410B1 second address: 12410C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CE76BBDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12410C5 second address: 12410D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA97CDB0706h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12411FF second address: 1241215 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CE76BC2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1241215 second address: 1241272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jg 00007FA97CDB0706h 0x0000000d pop edx 0x0000000e jmp 00007FA97CDB0717h 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007FA97CDB0713h 0x0000001a push edi 0x0000001b jnp 00007FA97CDB0706h 0x00000021 pop edi 0x00000022 pushad 0x00000023 jmp 00007FA97CDB0712h 0x00000028 js 00007FA97CDB0706h 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1245C34 second address: 1245C53 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA97CE76BBCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA97CE76BBCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248B73 second address: 1248B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 jns 00007FA97CDB0706h 0x0000000e popad 0x0000000f jc 00007FA97CDB0712h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248B8A second address: 1248B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FA97CE76BB6h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248B9A second address: 1248BA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248BA0 second address: 1248BCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA97CE76BB6h 0x0000000a popad 0x0000000b jnc 00007FA97CE76BD1h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248BCC second address: 1248BF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CDB0715h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA97CDB070Bh 0x0000000e jl 00007FA97CDB0706h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124A552 second address: 124A556 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124A556 second address: 124A578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA97CDB0716h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124A578 second address: 124A57C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124A57C second address: 124A58B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CDB070Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166490 second address: 1166494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166494 second address: 11664A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA97CDB070Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11664A3 second address: 11664A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11664A9 second address: 11664AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11664AD second address: 11664C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c jmp 00007FA97CE76BBEh 0x00000011 pop edi 0x00000012 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FBB9F4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FBBACC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 115E053 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 115C6A3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1185E7B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11E7D15 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1558	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1437	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1107	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 8004	Thread sleep count: 58 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 8004	Thread sleep time: -116058s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 8000	Thread sleep count: 69 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 8000	Thread sleep time: -138069s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 8072	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7976	Thread sleep count: 1558 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7976	Thread sleep time: -3117558s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7524	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7980	Thread sleep count: 1437 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7980	Thread sleep time: -2875437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7980	Thread sleep count: 1107 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7980	Thread sleep time: -2215107s >= -30000s	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.3787332249.0000000000A38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: file.exe, 00000000.00000002.3787332249.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F9E470 LdrInitializeThunk,

0_2_00F9E470

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: p3ar11fter.sbs
Source: file.exe	String found in binary or memory: 3xp3cts1aim.sbs
Source: file.exe	String found in binary or memory: p10tgrace.sbs
Source: file.exe	String found in binary or memory: peepburry828.sbs
Source: file.exe	String found in binary or memory: processhol.sbs

Source: file.exe, file.exe, 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: ]Program Manager

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	41%	Virustotal		Browse
file.exe	39%	ReversingLabs
file.exe	100%	Avira	TR/Crypt.ZPACK.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://peepburry828.sbs/api	100%	Avira URL Cloud	malware
https://cook-rain.sbs:443/apibuH	100%	Avira URL Cloud	malware
https://cook-rain.sbs/xzw	100%	Avira URL Cloud	malware
https://peepburry828.sbs:443/api	100%	Avira URL Cloud	malware
https://owner-vacat10n.sbs/ilx	100%	Avira URL Cloud	malware
https://librari-night.sbs:443/api	100%	Avira URL Cloud	malware
https://owner-vacat10n.sbs/api9	100%	Avira URL Cloud	malware
https://peepburry828.sbs:443/api	16%	Virustotal		Browse
https://peepburry828.sbs/	0%	Avira URL Cloud	safe
https://librari-night.sbs/api	100%	Avira URL Cloud	malware
https://befall-sm0ker.sbs/api	100%	Avira URL Cloud	malware
https://befall-sm0ker.sbs:443/api	100%	Avira URL Cloud	malware
https://peepburry828.sbs/api	16%	Virustotal		Browse
https://befall-sm0ker.sbs/	100%	Avira URL Cloud	malware
https://owner-vacat10n.sbs:443/api	100%	Avira URL Cloud	malware
https://processhol.sbs:443/apiCu	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0014.t-0009.t-msedge.net	13.107.246.42	true	false	high
librari-night.sbs	104.21.85.146	true	false	high
owner-vacat10n.sbs	172.67.191.18	true	false	high
p10tgrace.sbs	172.67.150.203	true	false	high
cook-rain.sbs	188.114.96.3	true	false	high
befall-sm0ker.sbs	188.114.97.3	true	false	high
3xp3cts1aim.sbs	188.114.96.3	true	false	high
peepburry828.sbs	188.114.97.3	true	false	high
processhol.sbs	188.114.96.3	true	false	high

Contacted URLs

Name	Malicious	Reputation
p10tgrace.sbs	false	high
p3ar11fter.sbs	false	high
peepburry828.sbs	false	high
processhol.sbs	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://cook-rain.sbs:443/apibuH	file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cook-rain.sbs/xzw	file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://peepburry828.sbs/api	file.exe, 00000000.00000002.3787332249.0000000000A38000.00000004.00000020.00020000.00000000.sdmp	false	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://peepburry828.sbs:443/api	file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	false	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://owner-vacat10n.sbs/ilx	file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cook-rain.sbs/api	file.exe, 00000000.00000002.3787332249.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://librari-night.sbs:443/api	file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://owner-vacat10n.sbs/api9	file.exe, 00000000.00000002.3787332249.0000000000A38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://peepburry828.sbs/	file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://librari-night.sbs/api	file.exe, 00000000.00000002.3787332249.0000000000A38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://befall-sm0ker.sbs/api	file.exe, 00000000.00000002.3787332249.0000000000A38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://befall-sm0ker.sbs:443/api	file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://befall-sm0ker.sbs/	file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://owner-vacat10n.sbs:443/api	file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://processhol.sbs:443/apiCu	file.exe, 00000000.00000002.3787332249.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.150.203	p10tgrace.sbs	United States	13335	CLOUDFLARENETUS	false
188.114.97.3	befall-sm0ker.sbs	European Union	13335	CLOUDFLARENETUS	false
172.67.191.18	owner-vacat10n.sbs	United States	13335	CLOUDFLARENETUS	false
188.114.96.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false
104.21.85.146	librari-night.sbs	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558195
Start date and time:	2024-11-19 06:30:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@8/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
00:31:44	API Interceptor	12286798x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.150.203	file.exe	Get hash	malicious	LummaC	Browse
172.67.150.203	file.exe	Get hash	malicious	LummaC	Browse
188.114.97.3	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.ssrnoremt-rise.sbs/3jsc/
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/zWkbOqX7/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	gusetup.exe	Get hash	malicious	Unknown	Browse	www.glarysoft.com/update/glary-utilities/pro/pro50/
	Online Interview Scheduling Form.lnk	Get hash	malicious	Ducktail	Browse	gmtagency.online/api/check
	View Pdf Doc_0b40e7d2137cd39647abbd9321b34da7.htm	Get hash	malicious	Unknown	Browse	f7xiz.nhgrt.top/Kbo731/96f7xiZ96?&&V5G=YW5kZXJzLmhhcnR1bmcuY2hyaXN0ZW5zZW5Acm9ja3dvb2wuY29t
	SWIFT 103 202414111523339800 111124.pdf.vbs	Get hash	malicious	Remcos	Browse	paste.ee/d/YU1NN
	TT copy.exe	Get hash	malicious	FormBook	Browse	www.lnnn.fun/u5w9/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/iiEh1iM3/download
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	paste.ee/d/dc8Ru
172.67.191.18	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
188.114.96.3	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Bh1Kj4RD/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/7pdXjNKP/download
	gusetup.exe	Get hash	malicious	Unknown	Browse	go.glarysoft.com/g/t/releasenotes/cn/10000/s/Glary%20Utilities/v/6.16.0.20
	BlgAsBdkiD.exe	Get hash	malicious	FormBook	Browse	www.vrxlzluy.shop/d8g5/
	Facebook_Advertiser_Position_Description.lnk	Get hash	malicious	Ducktail	Browse	gmtagency.online/api/check
	https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%25A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/graylinelaketahoe.com&c=E,1,BWhR2At2OZAdw2Kzdn7d-U-fLZRdgzpdTFbcA87JOQxek-SzsLBqKBG-KMVpA5JovWFRbO4mN3q2zPe1YDaTOG57b4G9v05-IgsJXqrG4om_58_65Os9ldlZ&typo=1	Get hash	malicious	Unknown	Browse	graylinelaketahoe.com/
	View Pdf Doc_a42d45ecadd4b9604949c99fe71e46fe.htm	Get hash	malicious	Unknown	Browse	jssqm.nhgrt.top/WjBkrg/34JSSQm34?&&2yq=bC5zY2FybGF0ZWxsaUBhbG1hdml2YS5pdA%3D%3D

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0014.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.42
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.42
	INVOICE DUE.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.42
	PO-54752454235.hta	Get hash	malicious	Remcos	Browse	13.107.246.42
	http://frenzelit.powerappsportals.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.107.246.42
	https://gen-techs.site/s/ind.html#123@123.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	https://app.bitdam.com/api/v1.0/links/rewrite_click/?rewrite_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyZXdyaXRlX2lkIjoiNjcyOGQ2YzliOTFmMDRhNDE1NjM3NTRhIiwidXJsIjoiIiwib3JnYW5pemF0aW9uX2lkIjo1ODQwfQ.Uhd2nS1gN1sUzvqpPDTmoAH1ZU9vF-hNz1sM06cv-iA&url=https%3A//www.google.it/url%3Fq%3Dhttps%3A//www.google.it/url%3Fq%3Dhttps%3A//www.google.it/url%3Fq%3Dhttps%3A//www.google.ro/url%3Fq%3Dhttps%3A//www.google.nl/url%3Fq%3DZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%25A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%6E%65%77%68%6F%6D%65%73%76%6E%2E%63%6F%6D%2F%63%67%69%2F/3we/Y29saW4uZ3JhbnRAZmlyc3RvbnRhcmlvLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.42
	Order 1108739138.vbs	Get hash	malicious	Unknown	Browse	13.107.246.42
	ZtefPP1HI7.cmd	Get hash	malicious	Unknown	Browse	13.107.246.42
	(No subject) (86).eml	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.42
librari-night.sbs	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.85.146
	file.exe	Get hash	malicious	LummaC	Browse	104.21.85.146
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.172
	file.exe	Get hash	malicious	LummaC	Browse	104.21.85.146
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.172
	file.exe	Get hash	malicious	LummaC	Browse	104.21.85.146
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.85.146
	file.exe	Get hash	malicious	LummaC	Browse	193.143.1.19
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	193.143.1.19
	file.exe	Get hash	malicious	LummaC	Browse	193.143.1.19
p10tgrace.sbs	file.exe	Get hash	malicious	LummaC	Browse	172.67.150.203
	file.exe	Get hash	malicious	LummaC	Browse	172.67.150.203
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.150.203
	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.92
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.0.92
	file.exe	Get hash	malicious	LummaC	Browse	193.143.1.19
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	193.143.1.19
	file.exe	Get hash	malicious	LummaC	Browse	193.143.1.19
owner-vacat10n.sbs	file.exe	Get hash	malicious	LummaC	Browse	104.21.81.208
	file.exe	Get hash	malicious	LummaC	Browse	104.21.81.208
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.191.18
	file.exe	Get hash	malicious	LummaC	Browse	104.21.81.208
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.191.18
	file.exe	Get hash	malicious	LummaC	Browse	193.143.1.19
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	193.143.1.19
	file.exe	Get hash	malicious	LummaC	Browse	193.143.1.19

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.188.199
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.81.208
	DOCS.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	5674656777985-069688574654 pdf.exe	Get hash	malicious	FormBook	Browse	104.21.15.100
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.188.199
	rPO_1079021908.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.85.146
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.188.199
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.81.208
	DOCS.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	5674656777985-069688574654 pdf.exe	Get hash	malicious	FormBook	Browse	104.21.15.100
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.188.199
	rPO_1079021908.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.85.146
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.188.199
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.81.208
	DOCS.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	5674656777985-069688574654 pdf.exe	Get hash	malicious	FormBook	Browse	104.21.15.100
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.188.199
	rPO_1079021908.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.85.146
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.188.199
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.81.208
	DOCS.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	5674656777985-069688574654 pdf.exe	Get hash	malicious	FormBook	Browse	104.21.15.100
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.188.199
	rPO_1079021908.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.85.146

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946755835842997
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'830'400 bytes
MD5:	afd25f2fa473d794759a6e9f51c50d87
SHA1:	4f874fd536a0a8a0cf044ee47f25785a8a957c4d
SHA256:	473ab5b030273598bc64ab38aafdc6666239c7aa63682f3ef44ffd9dec83b576
SHA512:	834e73f6e671375f844f97c9620aff1da7d2d755a8e7f4c4a6cf458207f763478f594499b821b5d74191ca097e347cba5ef91f0ecb205f1666522388cb95bd4e
SSDEEP:	49152:m6MeKCyNJY7lRIkrucgyud89XJn4x4Wm:vYNmTHicgye0XJsm
TLSH:	9C85337E5F02AA86DA1180B8407B8289CB1609974077FF2C78AF5F7E7157B8DB0D34A5
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g..............................H...........@...........................H.....V.....@.................................\p..p..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x88b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x673B72E6 [Mon Nov 18 17:01:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FA97C6F88FAh
bswap esp
sbb eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FA97C6FA8F5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi+00000004h], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
jnle 00007FA97C6F8872h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor eax, dword ptr [ecx]
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5705c	0x70	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x571f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x55000	0x25e00	5bd24988b51183538cbc8d95ab953c38	False	0.9974280631188119	data	7.981310490186909	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x56000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x57000	0x1000	0x200	b32b7c4ad821f82288405a0d11e75f2f	False	0.15625	data	1.1076713340399604	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x58000	0x29c000	0x200	76e424e289fb3bc5a021c5f20c1ffbb7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wrtbandm	0x2f4000	0x196000	0x195600	4eb53573cb50dde1a8bcbbd2c1b88f90	False	0.9942020553885291	data	7.952710850398654	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cneunvgm	0x48a000	0x1000	0x400	c1333da171185fa713e4c4575eea888c	False	0.791015625	data	6.203514087246149	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x48b000	0x3000	0x2200	700fd3b660393e0c14a9fc20c32c4b68	False	0.06881893382352941	DOS executable (COM)	0.7898339052646832	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-19T06:31:09.050426+0100	2057653	ET MALWARE Observed Win32/Lumma Stealer Related Domain (3xp3cts1aim .sbs in TLS SNI)	1	192.168.2.10	49728	188.114.96.3	443	TCP
2024-11-19T06:31:09.050426+0100	2057699	ET MALWARE Observed Lumma Stealer Domain (3xp3cts1aim .sbs in TLS SNI)	1	192.168.2.10	49728	188.114.96.3	443	TCP
2024-11-19T06:31:09.050426+0100	2057653	ET MALWARE Observed Win32/Lumma Stealer Related Domain (3xp3cts1aim .sbs in TLS SNI)	1	192.168.2.10	49722	188.114.96.3	443	TCP
2024-11-19T06:31:09.050426+0100	2057699	ET MALWARE Observed Lumma Stealer Domain (3xp3cts1aim .sbs in TLS SNI)	1	192.168.2.10	49722	188.114.96.3	443	TCP
2024-11-19T06:31:09.050426+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49722	188.114.96.3	443	TCP
2024-11-19T06:31:47.957664+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49702	188.114.96.3	443	TCP
2024-11-19T06:31:47.961546+0100	2057668	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (processhol .sbs)	1	192.168.2.10	53151	1.1.1.1	53	UDP
2024-11-19T06:31:47.961546+0100	2057697	ET MALWARE Observed DNS Query to Lumma Stealer Domain (processhol .sbs)	1	192.168.2.10	53151	1.1.1.1	53	UDP
2024-11-19T06:31:59.956867+0100	2057669	ET MALWARE Observed Win32/Lumma Stealer Related Domain (processhol .sbs in TLS SNI)	1	192.168.2.10	49709	188.114.96.3	443	TCP
2024-11-19T06:31:59.956867+0100	2057701	ET MALWARE Observed Lumma Stealer Domain (processhol .sbs in TLS SNI)	1	192.168.2.10	49709	188.114.96.3	443	TCP
2024-11-19T06:31:59.956867+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49709	188.114.96.3	443	TCP
2024-11-19T06:31:59.958471+0100	2057658	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (librari-night .sbs)	1	192.168.2.10	60902	1.1.1.1	53	UDP
2024-11-19T06:32:03.957350+0100	2057659	ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI)	1	192.168.2.10	49716	104.21.85.146	443	TCP
2024-11-19T06:32:03.957350+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49716	104.21.85.146	443	TCP
2024-11-19T06:32:03.961542+0100	2057654	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (befall-sm0ker .sbs)	1	192.168.2.10	51216	1.1.1.1	53	UDP
2024-11-19T06:32:07.957028+0100	2057655	ET MALWARE Observed Win32/Lumma Stealer Related Domain (befall-sm0ker .sbs in TLS SNI)	1	192.168.2.10	49717	188.114.97.3	443	TCP
2024-11-19T06:32:07.957028+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49717	188.114.97.3	443	TCP
2024-11-19T06:32:07.960537+0100	2057662	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (p10tgrace .sbs)	1	192.168.2.10	55757	1.1.1.1	53	UDP
2024-11-19T06:32:11.957031+0100	2057663	ET MALWARE Observed Win32/Lumma Stealer Related Domain (p10tgrace .sbs in TLS SNI)	1	192.168.2.10	49718	172.67.150.203	443	TCP
2024-11-19T06:32:11.957031+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49718	172.67.150.203	443	TCP
2024-11-19T06:32:11.958928+0100	2057666	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (peepburry828 .sbs)	1	192.168.2.10	63118	1.1.1.1	53	UDP
2024-11-19T06:32:11.958928+0100	2057696	ET MALWARE Observed DNS Query to Lumma Stealer Domain (peepburry828 .sbs)	1	192.168.2.10	63118	1.1.1.1	53	UDP
2024-11-19T06:32:15.968896+0100	2057667	ET MALWARE Observed Win32/Lumma Stealer Related Domain (peepburry828 .sbs in TLS SNI)	1	192.168.2.10	49719	188.114.97.3	443	TCP
2024-11-19T06:32:15.968896+0100	2057700	ET MALWARE Observed Lumma Stealer Domain (peepburry828 .sbs in TLS SNI)	1	192.168.2.10	49719	188.114.97.3	443	TCP
2024-11-19T06:32:15.968896+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49719	188.114.97.3	443	TCP
2024-11-19T06:32:15.971883+0100	2057660	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (owner-vacat10n .sbs)	1	192.168.2.10	58020	1.1.1.1	53	UDP
2024-11-19T06:32:19.957034+0100	2057661	ET MALWARE Observed Win32/Lumma Stealer Related Domain (owner-vacat10n .sbs in TLS SNI)	1	192.168.2.10	49721	172.67.191.18	443	TCP
2024-11-19T06:32:19.957034+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49721	172.67.191.18	443	TCP
2024-11-19T06:32:19.959844+0100	2057652	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (3xp3cts1aim .sbs)	1	192.168.2.10	51980	1.1.1.1	53	UDP
2024-11-19T06:32:19.959844+0100	2057695	ET MALWARE Observed DNS Query to Lumma Stealer Domain (3xp3cts1aim .sbs)	1	192.168.2.10	51980	1.1.1.1	53	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 06:31:16.056236982 CET	49702	443	192.168.2.10	188.114.96.3
Nov 19, 2024 06:31:16.056368113 CET	443	49702	188.114.96.3	192.168.2.10
Nov 19, 2024 06:31:16.056483984 CET	49702	443	192.168.2.10	188.114.96.3
Nov 19, 2024 06:31:16.057881117 CET	49702	443	192.168.2.10	188.114.96.3
Nov 19, 2024 06:31:16.057924986 CET	443	49702	188.114.96.3	192.168.2.10
Nov 19, 2024 06:31:47.957664013 CET	49702	443	192.168.2.10	188.114.96.3
Nov 19, 2024 06:31:48.019638062 CET	49709	443	192.168.2.10	188.114.96.3
Nov 19, 2024 06:31:48.019665003 CET	443	49709	188.114.96.3	192.168.2.10
Nov 19, 2024 06:31:48.019732952 CET	49709	443	192.168.2.10	188.114.96.3
Nov 19, 2024 06:31:48.020684004 CET	49709	443	192.168.2.10	188.114.96.3
Nov 19, 2024 06:31:48.020692110 CET	443	49709	188.114.96.3	192.168.2.10
Nov 19, 2024 06:31:59.956866980 CET	49709	443	192.168.2.10	188.114.96.3
Nov 19, 2024 06:31:59.998681068 CET	49716	443	192.168.2.10	104.21.85.146
Nov 19, 2024 06:31:59.998708963 CET	443	49716	104.21.85.146	192.168.2.10
Nov 19, 2024 06:31:59.998814106 CET	49716	443	192.168.2.10	104.21.85.146
Nov 19, 2024 06:31:59.999191046 CET	49716	443	192.168.2.10	104.21.85.146
Nov 19, 2024 06:31:59.999206066 CET	443	49716	104.21.85.146	192.168.2.10
Nov 19, 2024 06:32:03.957350016 CET	49716	443	192.168.2.10	104.21.85.146
Nov 19, 2024 06:32:04.012655020 CET	49717	443	192.168.2.10	188.114.97.3
Nov 19, 2024 06:32:04.012685061 CET	443	49717	188.114.97.3	192.168.2.10
Nov 19, 2024 06:32:04.012768030 CET	49717	443	192.168.2.10	188.114.97.3
Nov 19, 2024 06:32:04.014246941 CET	49717	443	192.168.2.10	188.114.97.3
Nov 19, 2024 06:32:04.014261007 CET	443	49717	188.114.97.3	192.168.2.10
Nov 19, 2024 06:32:07.957027912 CET	49717	443	192.168.2.10	188.114.97.3
Nov 19, 2024 06:32:08.009474039 CET	49718	443	192.168.2.10	172.67.150.203
Nov 19, 2024 06:32:08.009502888 CET	443	49718	172.67.150.203	192.168.2.10
Nov 19, 2024 06:32:08.010481119 CET	49718	443	192.168.2.10	172.67.150.203
Nov 19, 2024 06:32:08.010482073 CET	49718	443	192.168.2.10	172.67.150.203
Nov 19, 2024 06:32:08.010514975 CET	443	49718	172.67.150.203	192.168.2.10
Nov 19, 2024 06:32:11.957031012 CET	49718	443	192.168.2.10	172.67.150.203
Nov 19, 2024 06:32:11.998959064 CET	49719	443	192.168.2.10	188.114.97.3
Nov 19, 2024 06:32:11.998987913 CET	443	49719	188.114.97.3	192.168.2.10
Nov 19, 2024 06:32:11.999175072 CET	49719	443	192.168.2.10	188.114.97.3
Nov 19, 2024 06:32:11.999588966 CET	49719	443	192.168.2.10	188.114.97.3
Nov 19, 2024 06:32:11.999602079 CET	443	49719	188.114.97.3	192.168.2.10
Nov 19, 2024 06:32:15.968895912 CET	49719	443	192.168.2.10	188.114.97.3
Nov 19, 2024 06:32:16.024985075 CET	49721	443	192.168.2.10	172.67.191.18
Nov 19, 2024 06:32:16.025024891 CET	443	49721	172.67.191.18	192.168.2.10
Nov 19, 2024 06:32:16.025089979 CET	49721	443	192.168.2.10	172.67.191.18
Nov 19, 2024 06:32:16.025425911 CET	49721	443	192.168.2.10	172.67.191.18
Nov 19, 2024 06:32:16.025439978 CET	443	49721	172.67.191.18	192.168.2.10
Nov 19, 2024 06:32:19.957034111 CET	49721	443	192.168.2.10	172.67.191.18
Nov 19, 2024 06:32:20.000973940 CET	49722	443	192.168.2.10	188.114.96.3
Nov 19, 2024 06:32:20.001019001 CET	443	49722	188.114.96.3	192.168.2.10
Nov 19, 2024 06:32:20.001372099 CET	49722	443	192.168.2.10	188.114.96.3
Nov 19, 2024 06:32:20.001959085 CET	49722	443	192.168.2.10	188.114.96.3
Nov 19, 2024 06:32:20.001976967 CET	443	49722	188.114.96.3	192.168.2.10
Nov 19, 2024 06:34:30.052184105 CET	443	49722	188.114.96.3	192.168.2.10
Nov 19, 2024 06:34:30.064341068 CET	49728	443	192.168.2.10	188.114.96.3
Nov 19, 2024 06:34:30.064435005 CET	443	49728	188.114.96.3	192.168.2.10
Nov 19, 2024 06:34:30.064522028 CET	49728	443	192.168.2.10	188.114.96.3
Nov 19, 2024 06:34:30.065148115 CET	49728	443	192.168.2.10	188.114.96.3
Nov 19, 2024 06:34:30.065186977 CET	443	49728	188.114.96.3	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 06:31:16.007453918 CET	52527	53	192.168.2.10	1.1.1.1
Nov 19, 2024 06:31:16.050002098 CET	53	52527	1.1.1.1	192.168.2.10
Nov 19, 2024 06:31:47.961545944 CET	53151	53	192.168.2.10	1.1.1.1
Nov 19, 2024 06:31:48.017496109 CET	53	53151	1.1.1.1	192.168.2.10
Nov 19, 2024 06:31:59.958471060 CET	60902	53	192.168.2.10	1.1.1.1
Nov 19, 2024 06:31:59.997629881 CET	53	60902	1.1.1.1	192.168.2.10
Nov 19, 2024 06:32:03.961541891 CET	51216	53	192.168.2.10	1.1.1.1
Nov 19, 2024 06:32:04.011827946 CET	53	51216	1.1.1.1	192.168.2.10
Nov 19, 2024 06:32:07.960536957 CET	55757	53	192.168.2.10	1.1.1.1
Nov 19, 2024 06:32:08.007790089 CET	53	55757	1.1.1.1	192.168.2.10
Nov 19, 2024 06:32:11.958928108 CET	63118	53	192.168.2.10	1.1.1.1
Nov 19, 2024 06:32:11.997793913 CET	53	63118	1.1.1.1	192.168.2.10
Nov 19, 2024 06:32:15.971883059 CET	58020	53	192.168.2.10	1.1.1.1
Nov 19, 2024 06:32:16.024131060 CET	53	58020	1.1.1.1	192.168.2.10
Nov 19, 2024 06:32:19.959844112 CET	51980	53	192.168.2.10	1.1.1.1
Nov 19, 2024 06:32:19.999131918 CET	53	51980	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 19, 2024 06:31:16.007453918 CET	192.168.2.10	1.1.1.1	0x23d1	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:31:47.961545944 CET	192.168.2.10	1.1.1.1	0x2a9b	Standard query (0)	processhol.sbs	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:31:59.958471060 CET	192.168.2.10	1.1.1.1	0xe35	Standard query (0)	librari-night.sbs	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:32:03.961541891 CET	192.168.2.10	1.1.1.1	0x328f	Standard query (0)	befall-sm0ker.sbs	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:32:07.960536957 CET	192.168.2.10	1.1.1.1	0x8e2c	Standard query (0)	p10tgrace.sbs	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:32:11.958928108 CET	192.168.2.10	1.1.1.1	0xbf0d	Standard query (0)	peepburry828.sbs	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:32:15.971883059 CET	192.168.2.10	1.1.1.1	0x404c	Standard query (0)	owner-vacat10n.sbs	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:32:19.959844112 CET	192.168.2.10	1.1.1.1	0x6b6f	Standard query (0)	3xp3cts1aim.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 19, 2024 06:31:11.112590075 CET	1.1.1.1	192.168.2.10	0x5edc	No error (0)	shed.dual-low.s-part-0014.t-0009.t-msedge.net	s-part-0014.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 06:31:11.112590075 CET	1.1.1.1	192.168.2.10	0x5edc	No error (0)	s-part-0014.t-0009.t-msedge.net		13.107.246.42	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:31:16.050002098 CET	1.1.1.1	192.168.2.10	0x23d1	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:31:16.050002098 CET	1.1.1.1	192.168.2.10	0x23d1	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:31:48.017496109 CET	1.1.1.1	192.168.2.10	0x2a9b	No error (0)	processhol.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:31:48.017496109 CET	1.1.1.1	192.168.2.10	0x2a9b	No error (0)	processhol.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:31:59.997629881 CET	1.1.1.1	192.168.2.10	0xe35	No error (0)	librari-night.sbs		104.21.85.146	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:31:59.997629881 CET	1.1.1.1	192.168.2.10	0xe35	No error (0)	librari-night.sbs		172.67.206.172	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:32:04.011827946 CET	1.1.1.1	192.168.2.10	0x328f	No error (0)	befall-sm0ker.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:32:04.011827946 CET	1.1.1.1	192.168.2.10	0x328f	No error (0)	befall-sm0ker.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:32:08.007790089 CET	1.1.1.1	192.168.2.10	0x8e2c	No error (0)	p10tgrace.sbs		172.67.150.203	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:32:08.007790089 CET	1.1.1.1	192.168.2.10	0x8e2c	No error (0)	p10tgrace.sbs		104.21.0.92	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:32:11.997793913 CET	1.1.1.1	192.168.2.10	0xbf0d	No error (0)	peepburry828.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:32:11.997793913 CET	1.1.1.1	192.168.2.10	0xbf0d	No error (0)	peepburry828.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:32:16.024131060 CET	1.1.1.1	192.168.2.10	0x404c	No error (0)	owner-vacat10n.sbs		172.67.191.18	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:32:16.024131060 CET	1.1.1.1	192.168.2.10	0x404c	No error (0)	owner-vacat10n.sbs		104.21.81.208	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:32:19.999131918 CET	1.1.1.1	192.168.2.10	0x6b6f	No error (0)	3xp3cts1aim.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 06:32:19.999131918 CET	1.1.1.1	192.168.2.10	0x6b6f	No error (0)	3xp3cts1aim.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: file.exePID: 7920, Parent PID: 3968

General

Target ID:	0
Start time:	00:31:14
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf60000
File size:	1'830'400 bytes
MD5 hash:	AFD25F2FA473D794759A6E9F51C50D87
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 7920, Parent PID: 3968COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	59.4%
Total number of Nodes:	207
Total number of Limit Nodes:	10

Executed Functions

Function 00F6BDB0 Relevance: 7.6, Strings: 6, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

m?i!, xrefs: 00F6BFC7
~+*-, xrefs: 00F6BFE8
u#{%, xrefs: 00F6BFD2
[:], xrefs: 00F6BE19
J's), xrefs: 00F6BFDD
AK, xrefs: 00F6BF2D

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: AK$J's)$m?i!$u#{%$~+*-$[:]
API String ID: 0-2167574748
Opcode ID: 86706a8ef7edc3205e17de5193aec786851b77a36996bf7d297277689ebb3440
Instruction ID: 99bb3c4c010bb2392b1121503ca55c8925c074ed9c6ff205b80567399c0a67b6
Opcode Fuzzy Hash: 86706a8ef7edc3205e17de5193aec786851b77a36996bf7d297277689ebb3440
Instruction Fuzzy Hash: 3751DCB45593848BE3748F118482B8FBBB1FB92310F548A1CE6D86B794DBB84446CF97

Function 00F9E470 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00F7173D), ref: 00F9E49E

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00F68F20 Relevance: .2, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31d8d65b88d7a6041f0ac94fedda6e6333a0dcec0682872a0176b0f7ba790842
Instruction ID: 54b1459018d2845636b470a30f36ec6b9f367e55e4b0e77b402c726343b969b0
Opcode Fuzzy Hash: 31d8d65b88d7a6041f0ac94fedda6e6333a0dcec0682872a0176b0f7ba790842
Instruction Fuzzy Hash: EA518CB7F843150BD318AAA68CC23ABF99B8BC4364F0EA53C5D80CB381EDB99C0551D1

Function 00F9BAB0 Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 00F9BB5B

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 4921d78f99d4fb3bc68377ba02f894aafb42111791adce0edbae27d9ef887dfc
Instruction ID: bc7cd5fae0a32ae90befc7eda5b73dfb3347cf613b04b3c17f07791850f08969
Opcode Fuzzy Hash: 4921d78f99d4fb3bc68377ba02f894aafb42111791adce0edbae27d9ef887dfc
Instruction Fuzzy Hash: 5F11AFB26593099BC728AE99DCC67A377F2DF80348F14013DD6D24A351E178591EE744

Non-executed Functions

Function 00F84800 Relevance: 16.8, Strings: 13, Instructions: 508
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@A, xrefs: 00F84CFD
;M|C, xrefs: 00F84CF5
8I>O, xrefs: 00F84CED
]!S', xrefs: 00F84CBD
V%C;, xrefs: 00F84CC5
C1D7, xrefs: 00F84CDD
C5+K, xrefs: 00F84CE5
H=K3, xrefs: 00F84CD5
<=, xrefs: 00F84E15
YW, xrefs: 00F84DDD
_9_?, xrefs: 00F84CCD
_-_#, xrefs: 00F84CB5
;IJK, xrefs: 00F84B77

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: 8I>O$;IJK$;M|C$<=$@A$C1D7$C5+K$H=K3$V%C;$]!S'$_-_#$_9_?$YW
API String ID: 0-1278073768
Opcode ID: 283d3738ce403d81349a3ac92c1eccfc03de56bfe5c14820c51e5f42d91d4e4e
Instruction ID: 63084e84cd91a53e2593bbcdd507bbec9f7d98c188aed89909823d2e26c8ce53
Opcode Fuzzy Hash: 283d3738ce403d81349a3ac92c1eccfc03de56bfe5c14820c51e5f42d91d4e4e
Instruction Fuzzy Hash: 1CF1DBB160C3419FD700EF24E8917ABBBE1FF86354F05892CE8D58B290E7789905DB86

Function 00F82BA0 Relevance: 13.1, Strings: 10, Instructions: 644
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,, xrefs: 00F831FD
w, xrefs: 00F8328C
!@, xrefs: 00F82BD3
L, xrefs: 00F83043
E, xrefs: 00F83048
A, xrefs: 00F8304D
", xrefs: 00F82E21
D, xrefs: 00F8303E
K, xrefs: 00F83291
J, xrefs: 00F83296

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: !@$"$,$A$D$E$J$K$L$w
API String ID: 0-3285155985
Opcode ID: aa21bb618ccdf0b00119c24753e34ec21106f5e687780b43550889e21b2838e1
Instruction ID: 014c900e5a45ebe8dc9ba66430d794c1f003290ad68ca24a380472aab8119364
Opcode Fuzzy Hash: aa21bb618ccdf0b00119c24753e34ec21106f5e687780b43550889e21b2838e1
Instruction Fuzzy Hash: C4420472A0C7808BD3249B28C8853AEBBE1ABD6324F18893DE5D5C73D1D7788945E743

Function 01125BAA Relevance: 12.9, Strings: 9, Instructions: 1601
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

BJ7, xrefs: 0112617F
Uk{y, xrefs: 01126398
l=?V, xrefs: 01126B75
!2}, xrefs: 01125F57
n[>, xrefs: 01125EC6
7m9., xrefs: 011261F2
8|O, xrefs: 01126577
)ryo, xrefs: 01126A0C
ajYC!2}, xrefs: 011265FB

Memory Dump Source

Source File: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: !2}$)ryo$7m9.$8|O$BJ7$Uk{y$ajYC!2}$l=?V$n[>
API String ID: 0-3331946455
Opcode ID: 95b6d392aafaa843a2607ea75c5be752c2559fbf64f0fa1d45b35c8f40985c97
Instruction ID: c659876a0f89fafd4929726ea570555f77c68b2992120ec0b68df2d955db157f
Opcode Fuzzy Hash: 95b6d392aafaa843a2607ea75c5be752c2559fbf64f0fa1d45b35c8f40985c97
Instruction Fuzzy Hash: 09B2F7F36082149FE304AE29EC8567AFBE9EFD4720F16853DEAC4C3744E63598058796

Function 0112C59E Relevance: 11.6, Strings: 8, Instructions: 1630
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|3], xrefs: 0112D46A
gOr, xrefs: 0112D051
1o_, xrefs: 0112D568
F,_M, xrefs: 0112D8CD
@S_, xrefs: 0112D179
w6, xrefs: 0112D165
W6u, xrefs: 0112C8DD
zL}, xrefs: 0112C97B

Memory Dump Source

Source File: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: 1o_$@S_$F,_M$W6u$gOr$zL}$|3]$w6
API String ID: 0-2492563059
Opcode ID: e10b13d6c5b82bf4ab051c15f31a2edd49dac03282f9e2f1f628f38b3e3fe12a
Instruction ID: 7611bc0efbb50e2b287e5e7141b10daa2c5c21b06a3e6425091427ee485b7d50
Opcode Fuzzy Hash: e10b13d6c5b82bf4ab051c15f31a2edd49dac03282f9e2f1f628f38b3e3fe12a
Instruction Fuzzy Hash: F0B214F3A0C2049FE3046E2DEC8566ABBE9EFD4720F1A4A3DE6C4C7744E63558058697

Function 00F99310 Relevance: 11.2, APIs: 2, Strings: 4, Instructions: 668COMMON

Download Yara Rule

Strings

0}bc, xrefs: 00F994FF
C, xrefs: 00F993BC
(), xrefs: 00F995AE
\, xrefs: 00F993C7

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: ()$0}bc$C$\
API String ID: 0-1726517784
Opcode ID: 075d33f7bd6c539de8b2570703d9b0a1a8abd0ab08902ac059e3b0333c18fac7
Instruction ID: 3e1c17d3ad557219e52213801741688dede09eac2e72930cbc305e1f075e8ee4
Opcode Fuzzy Hash: 075d33f7bd6c539de8b2570703d9b0a1a8abd0ab08902ac059e3b0333c18fac7
Instruction Fuzzy Hash: 9F223272A0C3019BEB14CF28CC45B6BBBE6EBC6314F19891CF4959B281D7B4D905DB92

Function 011240D8 Relevance: 10.3, Strings: 7, Instructions: 1550COMMON

Download Yara Rule

Strings

yw, xrefs: 01124888
i=>_, xrefs: 0112435D
{=wo, xrefs: 01124789
qv, xrefs: 01125378
{*5, xrefs: 01124826
x1m, xrefs: 011251BB
<2, xrefs: 01124386

Memory Dump Source

Source File: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: i=>_$qv$x1m$yw${*5${=wo$<2
API String ID: 0-4100573233
Opcode ID: 1331af53f204a9074e1bcf05e379b218f1584d4308b895db2110f2fbeeff2469
Instruction ID: 74fdde859d06a7b993e9ccb3e00e57055ac64b526756e6567eb93ce20559bd2b
Opcode Fuzzy Hash: 1331af53f204a9074e1bcf05e379b218f1584d4308b895db2110f2fbeeff2469
Instruction Fuzzy Hash: E0A21AF3A082009FE304AE2DEC8567AFBE6EFD4720F16853DE6C4C7744EA3558058696

Function 00F6CEF5 Relevance: 10.3, Strings: 8, Instructions: 293COMMON

Download Yara Rule

Strings

39my, xrefs: 00F6CFDC
+"#R, xrefs: 00F6CFC6
^GFA, xrefs: 00F6D236
-0p#, xrefs: 00F6CFD1
~sx=, xrefs: 00F6CFE7
c^.z, xrefs: 00F6D08A
6(S", xrefs: 00F6CFBB
.$[", xrefs: 00F6CFB0

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: +"#R$-0p#$.$["$39my$6(S"$^GFA$c^.z$~sx=
API String ID: 0-769485458
Opcode ID: 9ab3cb03a076cded09b6bbab289f5edb0cf981f902864c339a7dae6e6e1296e3
Instruction ID: 48e6e4bd589cb2be2263b48160a0d3632c5546d3d51eabf9f636ff24d2f8ea25
Opcode Fuzzy Hash: 9ab3cb03a076cded09b6bbab289f5edb0cf981f902864c339a7dae6e6e1296e3
Instruction Fuzzy Hash: C9A1C3B098C3C28FD3358F2585917EBBBE1ABA3314F18996CC5D98B245DB7904069B93

Function 01129052 Relevance: 9.1, Strings: 6, Instructions: 1645COMMON

Download Yara Rule

Strings

O{K, xrefs: 01129F78
F`_], xrefs: 01129E02
F`_], xrefs: 01129E20
;zh[, xrefs: 01129FF9
GN], xrefs: 0112A2C6
2Z__, xrefs: 011291E2

Memory Dump Source

Source File: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: 2Z__$;zh[$F`_]$F`_]$GN]$O{K
API String ID: 0-2086327690
Opcode ID: dd0f3fc45adecd5eee9bbaf578f7eff70a71653d89f71b8323ce710b15691584
Instruction ID: 98ed6b04cc17b15bdb94dbbccf3185494245190998330d587ea4fafa41aa67b1
Opcode Fuzzy Hash: dd0f3fc45adecd5eee9bbaf578f7eff70a71653d89f71b8323ce710b15691584
Instruction Fuzzy Hash: 21B2F5F3A082109FE704AE2DEC8567AFBE9EF94320F16493DEAC5D3744E63558018697

Function 00F7FC80 Relevance: 8.5, Strings: 6, Instructions: 961COMMON

Download Yara Rule

Strings

bbsx, xrefs: 00F80030
gjen, xrefs: 00F8001C
', xrefs: 00F7FE23
<$9(, xrefs: 00F7FFF4
8Y=, xrefs: 00F7FFEA
[ F:, xrefs: 00F7FFD5

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: 8Y=$<$9($[ F:$bbsx$gjen$'
API String ID: 0-1020086844
Opcode ID: 20e9ce2486de09db5bae548f04ebef22a4fcc4b374a1ed47fd250192087a0e9a
Instruction ID: af6ca2e04ea232edc21f2d100075546ed51c59892df108e05f3731bd1d9b7dd6
Opcode Fuzzy Hash: 20e9ce2486de09db5bae548f04ebef22a4fcc4b374a1ed47fd250192087a0e9a
Instruction Fuzzy Hash: 06722771A04B418FC735CF39C890756BBE2BF96310B588A6DD4E68B792DB34E809DB50

Function 00F6B6E0 Relevance: 7.9, Strings: 6, Instructions: 422COMMON

Download Yara Rule

Strings

21, xrefs: 00F6B9A2
6, xrefs: 00F6B9AC
|/.-, xrefs: 00F6BC8E
m+a), xrefs: 00F6BC87
QyFg, xrefs: 00F6B84E
;9, xrefs: 00F6B998

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: 21$6$;9$QyFg$m+a)$|/.-
API String ID: 0-3893809079
Opcode ID: e6f5f318e1299fc32ded34476159df585c6b6e2227ae5cb25a6529082aafd1d7
Instruction ID: 7a071ac20ae909ac0928f10b4919448df01e6845676d1ff02fca177aca948eac
Opcode Fuzzy Hash: e6f5f318e1299fc32ded34476159df585c6b6e2227ae5cb25a6529082aafd1d7
Instruction Fuzzy Hash: 5A0265B1210B05CFD3248F25D895B97BBF1FB45724F108A2CD5AB8BAA0DB74A445DF90

Function 00F6B220 Relevance: 7.9, Strings: 6, Instructions: 360COMMON

Download Yara Rule

Strings

LC, xrefs: 00F6B371
Bi, xrefs: 00F6B5E0
]/[, xrefs: 00F6B2D9
US, xrefs: 00F6B2C9
KQ, xrefs: 00F6B369
*, xrefs: 00F6B5E7

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: *$Bi$KQ$LC$US$]/[
API String ID: 0-74086816
Opcode ID: 88cc44fdb639a97f623493df67d5408fbb53dfe45cc29151c34f3dfda511b5e1
Instruction ID: 7fb5bc34778e3bd31ddf5db01d2cdef47212d95afca12fefbdca41780c157c6f
Opcode Fuzzy Hash: 88cc44fdb639a97f623493df67d5408fbb53dfe45cc29151c34f3dfda511b5e1
Instruction Fuzzy Hash: 53C148B1A4C3908BD3248F24949136BFBE1ABC2714F1CC96DE4D68B345D7768C46DB92

Function 01120C3C Relevance: 7.8, Strings: 5, Instructions: 1593COMMON

Download Yara Rule

Strings

6u, xrefs: 01120E5F
!{, xrefs: 01121DB1
_Ves, xrefs: 01120D57
Zu, xrefs: 01120DC2
"MG, xrefs: 011210C9

Memory Dump Source

Source File: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: !{$"MG$6u$Zu$_Ves
API String ID: 0-1481106790
Opcode ID: 75586e4046020db2e03efb29504011416de1ab8dc3634ce08d835b496a28857a
Instruction ID: 77578d5a96bc0d3571c955ee96baf81a60866a36c849055270da4723790b9234
Opcode Fuzzy Hash: 75586e4046020db2e03efb29504011416de1ab8dc3634ce08d835b496a28857a
Instruction Fuzzy Hash: 5DB2D3F3A0C6109FE3046E29EC8566AFBE9EF94720F1A492DEAC4C7344E63558418796

Function 00F69DC0 Relevance: 6.6, Strings: 5, Instructions: 399COMMON

Download Yara Rule

Strings

/PUR, xrefs: 00F69F2D
LO, xrefs: 00F6A11C
W _,, xrefs: 00F69F25
V\^R, xrefs: 00F69EFC, 00F69E55, 00F69E66, 00F69F50
s, xrefs: 00F69E90

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: /PUR$LO$V\^R$W _,$s
API String ID: 0-1118096989
Opcode ID: 38501fb4f6ec161e17a87ab7bcbc16a566bee5677e4e8602f0d32ee43bc97d94
Instruction ID: bb5b432ef5bb516911c6265425987521cee327c10d3692c15c40d3ca78b2abf6
Opcode Fuzzy Hash: 38501fb4f6ec161e17a87ab7bcbc16a566bee5677e4e8602f0d32ee43bc97d94
Instruction Fuzzy Hash: DEC120B06483808FD714DF25C89076BBBE2FFD1314F18892CE1D18B262DB79850ADB92

Function 00F85150 Relevance: 6.4, Strings: 5, Instructions: 105COMMON

Download Yara Rule

Strings

o7cI, xrefs: 00F85174
w3k5, xrefs: 00F85169
P?l1, xrefs: 00F851D0
X[, xrefs: 00F851AB
'O"A, xrefs: 00F8518A

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: 'O"A$P?l1$X[$o7cI$w3k5
API String ID: 0-455523353
Opcode ID: 58c88239ff6bac62a88a2391e93ac9d25e6cb232c24f8bded8c57530cf8880ad
Instruction ID: d1bda5f993be8e9a6a3d3a4b9203c8ee57f1d5eaeebf59867d8dec044def668f
Opcode Fuzzy Hash: 58c88239ff6bac62a88a2391e93ac9d25e6cb232c24f8bded8c57530cf8880ad
Instruction Fuzzy Hash: B63148B120C3859BD7349F54EC01FEBB7E4FBC6308F14492DF659CA281E67591068B16

Function 00F69940 Relevance: 5.4, Strings: 4, Instructions: 405COMMON

Download Yara Rule

Strings

cmj., xrefs: 00F69963
x, xrefs: 00F69C81
8, xrefs: 00F69CDA
OMIO, xrefs: 00F69D7E

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: 8$OMIO$cmj.$x
API String ID: 0-4161743809
Opcode ID: df6f11e26957ede61ae9d584a5c7ad413bf62493011c90b4395774672c3b0b2b
Instruction ID: 906601b2c0fd5251e22290f29723eed7a4f45cf2492dea21a841131ff6611141
Opcode Fuzzy Hash: df6f11e26957ede61ae9d584a5c7ad413bf62493011c90b4395774672c3b0b2b
Instruction Fuzzy Hash: 04C1C37264C3D18BD3218F29846035BBFE1AFD7350F084A6CE4D54B392D77A8909DB96

Function 0112FB8C Relevance: 5.4, Strings: 3, Instructions: 1601COMMON

Download Yara Rule

Strings

Ewn, xrefs: 01130A23
{, xrefs: 011303BB
5#mw, xrefs: 0112FCFA

Memory Dump Source

Source File: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: {$5#mw$Ewn
API String ID: 0-303425379
Opcode ID: 5d8743287c5dc790212b38ba4e99b650a2e0f54f11b75013851ef3949908d0a5
Instruction ID: 387cb440f52f7649b87d286e62a7b7a6aa9c5951466a27b77006016075b04972
Opcode Fuzzy Hash: 5d8743287c5dc790212b38ba4e99b650a2e0f54f11b75013851ef3949908d0a5
Instruction Fuzzy Hash: D5B2F5F360C2049FE3146E2DEC8567AFBE9EF94720F1A492DEAC4C3744E63598418697

Function 0112762C Relevance: 5.3, Strings: 3, Instructions: 1581COMMON

Download Yara Rule

Strings

Y^A1, xrefs: 011279C8
H*[{, xrefs: 0112815F
];Y}, xrefs: 01127ED0

Memory Dump Source

Source File: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: H*[{$Y^A1$];Y}
API String ID: 0-804533894
Opcode ID: 06c89e99cb47210d5524f6f43cdda3e34e839b76e0ae4bedc7d127cbb50a01de
Instruction ID: b48194df546fe941d79c98df9607ee4f7d9b715fa380687224d2a9db26bf23de
Opcode Fuzzy Hash: 06c89e99cb47210d5524f6f43cdda3e34e839b76e0ae4bedc7d127cbb50a01de
Instruction Fuzzy Hash: BEB2D2F360C2049FE304AE29EC8567AFBE9EF94720F16893DE6C4C7344E63598158697

Function 0112ABB1 Relevance: 5.3, Strings: 3, Instructions: 1577COMMON

Download Yara Rule

Strings

GS~s, xrefs: 0112B7D9
u=_}, xrefs: 0112B391
s??o, xrefs: 0112ABE4

Memory Dump Source

Source File: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: GS~s$s??o$u=_}
API String ID: 0-3360460733
Opcode ID: 143dcb35f169695bb628ebef0c9ae473b02abba3ae06f57dd3780780f2a25ca7
Instruction ID: b04610f508a9ff8a6eefd3717f30bdb17e7dd8e4e71019b1f4f471405615d3d8
Opcode Fuzzy Hash: 143dcb35f169695bb628ebef0c9ae473b02abba3ae06f57dd3780780f2a25ca7
Instruction Fuzzy Hash: 6BB2F5F3A0C2149FE304AE2DDC8566AFBE9EF94720F16493DEAC4C7740EA3558018697

Function 00F64440 Relevance: 4.2, Strings: 3, Instructions: 420COMMON

Download Yara Rule

Strings

IEND, xrefs: 00F648AC
), xrefs: 00F644C6
), xrefs: 00F644BC

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 74dd807ab3c5feb63c95f3131a2142b639394ef8acdcd489e87a67337a396dd1
Instruction ID: fe2db6d3f93bc7b76ca023cf60b10fec00a5bdb619bcf1697dbfdba6a7995be8
Opcode Fuzzy Hash: 74dd807ab3c5feb63c95f3131a2142b639394ef8acdcd489e87a67337a396dd1
Instruction Fuzzy Hash: 88F1F0B1A087019BD314DF28D85172BBBE0BB95314F14462DF9969B3C2DB75F814EB82

Function 00F6DCB7 Relevance: 4.1, Strings: 3, Instructions: 320COMMON

Download Yara Rule

Strings

$#, xrefs: 00F6E08D
@KFQ, xrefs: 00F6DDA3
_Q, xrefs: 00F6DF4D

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: $#$@KFQ$_Q
API String ID: 0-3024927050
Opcode ID: e5328fe49b4bc53e6afde5e8b975eca22eca1882446862341653b83a1023dd57
Instruction ID: e05c6f96dcd840297e77ac75a5029ecf08645d6d3f8f3e07208a55634c1e3f3e
Opcode Fuzzy Hash: e5328fe49b4bc53e6afde5e8b975eca22eca1882446862341653b83a1023dd57
Instruction Fuzzy Hash: 84B1CF75A0D3C28BD335CB25C5917EBBBE1AFE6314F08996CD0C94B242D779440ADB92

Function 00F98970 Relevance: 2.8, Strings: 2, Instructions: 264COMMON

Download Yara Rule

Strings

n, xrefs: 00F98B14
2, xrefs: 00F98B23

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: 2$n
API String ID: 0-2202813717
Opcode ID: 8d0f1b4f542bc2a1daceeeff30080f2f83204c935534a3797c8568c27c45a7a8
Instruction ID: 832edd93a70e63698595ab7be299c0a0525648f4c220f18c5b526c751dc20617
Opcode Fuzzy Hash: 8d0f1b4f542bc2a1daceeeff30080f2f83204c935534a3797c8568c27c45a7a8
Instruction Fuzzy Hash: E1911162A1D7D08AD711853C9C8434EAED25BE7234F2D8FAEE4E1873D2D569C806D363

Function 00F9BFC0 Relevance: 2.7, Strings: 2, Instructions: 219COMMON

Download Yara Rule

Strings

KJML, xrefs: 00F9BFF0
5|iL, xrefs: 00F9C140

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: 5|iL$KJML
API String ID: 2994545307-536917200
Opcode ID: 77ff63f1da4383b08b20cf993cf6d7e65a08d7f47484804fdb2b1615cbf2ae88
Instruction ID: 0755bee0b369484ffddbcf267b62f1e026b09ce26e3c058ab62b8dabf7e1416d
Opcode Fuzzy Hash: 77ff63f1da4383b08b20cf993cf6d7e65a08d7f47484804fdb2b1615cbf2ae88
Instruction Fuzzy Hash: 15610732A043109BEB10DF69DC8076BBBE2EBC6724F19D429D898A7362D735DC41A7C5

Function 00F84EE0 Relevance: 2.7, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

G*, xrefs: 00F84FAF
Sc, xrefs: 00F84F5A

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: G*$Sc
API String ID: 0-813664474
Opcode ID: 8778315251a78265fc655784c8980ecfc8cab4d1f875911325ac2a46951691ef
Instruction ID: ec85f48cd099d421123a336293ade4e58e0a32c3cad7a8dd6a012ccb83692ff7
Opcode Fuzzy Hash: 8778315251a78265fc655784c8980ecfc8cab4d1f875911325ac2a46951691ef
Instruction Fuzzy Hash: 7051F1B260C3459BD314DF24DC81B5FBAE5EBC6714F14C92CF58A8B281DB75880A9B93

Function 00FA1160 Relevance: 2.6, Strings: 2, Instructions: 121COMMON

Download Yara Rule

Strings

@, xrefs: 00FA11C9
P?l1, xrefs: 00FA1161

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @$P?l1
API String ID: 2994545307-4135037845
Opcode ID: 3f80995a78629fcd1b8bb285357374c7ab171dc2dd44f3977272efed9aa55152
Instruction ID: bb3d6d10e4c091a2a130c3ca2b0f28c6eb67c4ba6c6a87f99cb1d9a92146d089
Opcode Fuzzy Hash: 3f80995a78629fcd1b8bb285357374c7ab171dc2dd44f3977272efed9aa55152
Instruction Fuzzy Hash: 7F3130B56083089FC304DF58C8C176BBBF4FF9A354F01882DEA988B290D3359908DB96

Function 0112328F Relevance: 1.9, Strings: 1, Instructions: 621COMMON

Download Yara Rule

Strings

y1{, xrefs: 0112375C

Memory Dump Source

Source File: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: y1{
API String ID: 0-3607952542
Opcode ID: b4c0ed64fd863c0fe88ca1381c0028a35d0a370fc89c839d24ab58e56466da50
Instruction ID: b7479120914d7e6700de4ac5a5890a02e552dd79411e17a7ab30f3a11b52a24c
Opcode Fuzzy Hash: b4c0ed64fd863c0fe88ca1381c0028a35d0a370fc89c839d24ab58e56466da50
Instruction Fuzzy Hash: 0F1206B350C200AFE301AF29DC8577ABBE5EF94320F1A892DEAC4C7744EA355851C697

Function 00F87E50 Relevance: 1.7, Strings: 1, Instructions: 411COMMON

Download Yara Rule

Strings

KJML, xrefs: 00F87EA1

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: KJML
API String ID: 2994545307-719402181
Opcode ID: 483a6957b7aeea282085e148d2c98c7a79a3f6349faf2d9d5ae43c4e35a255d8
Instruction ID: 1df5f9b06f8b0d9edb92adaa1982ca128fedea9660decb89519a9d66d3820100
Opcode Fuzzy Hash: 483a6957b7aeea282085e148d2c98c7a79a3f6349faf2d9d5ae43c4e35a255d8
Instruction Fuzzy Hash: C3C16972A487018BD714EE24DC817BBB792EF95750F29852CD8868B391EA35DC07E781

Function 00FA15B0 Relevance: 1.6, Strings: 1, Instructions: 310COMMON

Download Yara Rule

Strings

P?l1, xrefs: 00FA15B1

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: P?l1
API String ID: 2994545307-1575507586
Opcode ID: 3c20b710926932b7040e250f0032af17df70a87835c3f3caaf7502ad85e25567
Instruction ID: 72fd76d6d7b43742bdfd3496562da38967368f78825421c6c2b3812ede17184f
Opcode Fuzzy Hash: 3c20b710926932b7040e250f0032af17df70a87835c3f3caaf7502ad85e25567
Instruction Fuzzy Hash: 1391D6B9A043019FC715DF18C490A3AB7E2FF9A760F1A492CE9818B361DB35EC11DB81

Function 00F66550 Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

,, xrefs: 00F666C3

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 8fa0784d4a3c4da7f7da94379acf70cb67b349246050947ca5ec2c8812b10dba
Instruction ID: bc3f57f668be6c54e014848e605f89e1150a569d56c563251eace6809fbd3949
Opcode Fuzzy Hash: 8fa0784d4a3c4da7f7da94379acf70cb67b349246050947ca5ec2c8812b10dba
Instruction Fuzzy Hash: 06B128716083819FD325CF68C88061BFBE0AFA9704F448E2DF5D997742D671EA18CB96

Function 01068776 Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

)=w~, xrefs: 0106887B

Memory Dump Source

Source File: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: )=w~
API String ID: 0-118422113
Opcode ID: f42befcd0d6260ae8e930a21804620140e9ff2b7061568d18e295db450f358ca
Instruction ID: 7904d11f0a106bc38b813c144f29568084511a4eb2ed373a8af0ccf5d3e5b54e
Opcode Fuzzy Hash: f42befcd0d6260ae8e930a21804620140e9ff2b7061568d18e295db450f358ca
Instruction Fuzzy Hash: 057148F3E086149BE3046E2CDC8536ABBEAEB94310F2B863DD9C9D3344E974584587C6

Function 01049798 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

]], xrefs: 010497E2

Memory Dump Source

Source File: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: ]]
API String ID: 0-1044460713
Opcode ID: e8a6d22b479b0a17727d50e41cc1038bb5b4f513d4780f7dfc72c8239f9e1b25
Instruction ID: 529563584a345e96c052c177a8c8f7576f8cb545ceab56d632b76134a037a94a
Opcode Fuzzy Hash: e8a6d22b479b0a17727d50e41cc1038bb5b4f513d4780f7dfc72c8239f9e1b25
Instruction Fuzzy Hash: 1C7107F3A082109BE305AE19DC4577AB7E6EF94720F1B893CDAC487780EA395C0186D6

Function 010912E4 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

!)s_, xrefs: 0109136D

Memory Dump Source

Source File: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: !)s_
API String ID: 0-4052749432
Opcode ID: cba2af9835d5b1661f6037b26b3f7352b488e69d67256d1cb92cea852f21f128
Instruction ID: 9558911c36848b3588ae8e4d338762cf5f2f4c443f807334ab631f345ed4796c
Opcode Fuzzy Hash: cba2af9835d5b1661f6037b26b3f7352b488e69d67256d1cb92cea852f21f128
Instruction Fuzzy Hash: 2E5118F3A086009FE7046E2DEC8477AB7D5EFC4320F1A853DD6C587780E93548418786

Function 0109956E Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

wZ>, xrefs: 010995CB

Memory Dump Source

Source File: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: wZ>
API String ID: 0-89288365
Opcode ID: e62760770aca191eb358bc3b189a6548fa6fbf214525a592aeae0883e9474492
Instruction ID: 87076d112b5cfb6662bd5f3055edaa733a66a1a4525c5e780ab29627274db0e0
Opcode Fuzzy Hash: e62760770aca191eb358bc3b189a6548fa6fbf214525a592aeae0883e9474492
Instruction Fuzzy Hash: 085106F3A08B009FE7446E3DDC8536AB7D6EBD4320F2B892DE6C4C7744EA7444458686

Function 01000C54 Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

,=z~, xrefs: 01000D75

Memory Dump Source

Source File: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: ,=z~
API String ID: 0-2239656990
Opcode ID: fac0fd5903a99022af43ff388ddaa8d0af2536409a347e0a159e4b80ccfd3fa6
Instruction ID: 9293d96b159159f252eefd44e81ecc86a72628f310789c4c989e2b438087bc20
Opcode Fuzzy Hash: fac0fd5903a99022af43ff388ddaa8d0af2536409a347e0a159e4b80ccfd3fa6
Instruction Fuzzy Hash: D54127F3A182085BF348AA3CDC59777B799E740310F2A463DE686D77C4F9399905828A

Function 00F80CD0 Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

3q4, xrefs: 00F80E6A

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: 3q4
API String ID: 0-3801341962
Opcode ID: a6bc5c426ea96bae5f562a01655a500cfd8c04d4f6143e5914f222fdff806a7a
Instruction ID: 713f1040a47db1b27afc9c55dcb94d9945bfe029753cb67ad746ddf394336c10
Opcode Fuzzy Hash: a6bc5c426ea96bae5f562a01655a500cfd8c04d4f6143e5914f222fdff806a7a
Instruction Fuzzy Hash: 9E4103B1609344AFD340EF64DC85A5B7BE4EB8A365F08883CF584C6281DA78D90997A3

Function 00F6CA6A Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

tw, xrefs: 00F6CAF4

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: tw
API String ID: 0-3303754386
Opcode ID: 61ecf979f3475472e893abc5f4d9eac8f04b55a40df8562df308eb1b28007eea
Instruction ID: bb501494393a79576f14e5dc6790cc3ef07994e9b53ed401f4bb79a5792291d5
Opcode Fuzzy Hash: 61ecf979f3475472e893abc5f4d9eac8f04b55a40df8562df308eb1b28007eea
Instruction Fuzzy Hash: 8A21337661D3808FD714CF24C8E136BFBF2EBE6314F25982CE59243281CAB5D9009B46

Function 00F9FB70 Relevance: .8, Instructions: 825COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a53db0955ab03b6dd4bb2763cbae95eb1245216c09675fb4b77b4fd0fc2c9bc
Instruction ID: 5b64538a822af3b9dda36ebf8b2994387c97fdbdf5b86e31c45400ef91f47c3b
Opcode Fuzzy Hash: 9a53db0955ab03b6dd4bb2763cbae95eb1245216c09675fb4b77b4fd0fc2c9bc
Instruction Fuzzy Hash: 82321176A08315CFC704DF28E89066AB7E2FB8A314F1E897DD98587361D730E859DB42

Function 00F67BB0 Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d0613cad7b07f43e7f17b605332ffb618e2260b6ba873c354ae63f412ccab4
Instruction ID: ebc4fad954a0d94748c15d33f58376d5528f89d9cc4fe9ccce346d0b09c9a3e9
Opcode Fuzzy Hash: c3d0613cad7b07f43e7f17b605332ffb618e2260b6ba873c354ae63f412ccab4
Instruction Fuzzy Hash: 9A423B329087118BC724DF18D88027BB3E2FFC4358F298A2DD98597385EB35E956D782

Function 00F64F8F Relevance: .7, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a772c20fb00f915a52fcdeac66ca96da6f7a1f80535782b979e68ac1e6ecdc9d
Instruction ID: 6393443ddf2bb839d2fddf8a5e97469145dd5d68ba715b4b70a62aa2f567a732
Opcode Fuzzy Hash: a772c20fb00f915a52fcdeac66ca96da6f7a1f80535782b979e68ac1e6ecdc9d
Instruction Fuzzy Hash: 0D5256B5200B04CFDB28CF28D860756BBF2BF49755F18896CD84A8BA91C375E995DF80

Function 00F80EA0 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 782c04906a52d6f5dc45c9cb10bcea11ed4c23cd2b2779039bb1b1409b29a54b
Instruction ID: f1db44b46840c3df2be1be381d0112d573ddf154250ecb2a9f8339bb0e47abad
Opcode Fuzzy Hash: 782c04906a52d6f5dc45c9cb10bcea11ed4c23cd2b2779039bb1b1409b29a54b
Instruction Fuzzy Hash: 57626BB0508F818ED3368B3C8859797BFD56B6A324F084A9DE0FA8B3D2C7756105C766

Function 00F670A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c330f904242702b7af7ba497596817d215cc2c67ee2b78c89aaabaaa5feac4b8
Instruction ID: 4f86fdcf3a4db8f0726f574fe63f6c92479009a53e3b0ac1f40f52314123a83d
Opcode Fuzzy Hash: c330f904242702b7af7ba497596817d215cc2c67ee2b78c89aaabaaa5feac4b8
Instruction Fuzzy Hash: 7752E470D0CB848FE734EB34C4847A7BBE1AB91328F144C2DD5E606B86C67DA985EB51

Function 00F63060 Relevance: .7, Instructions: 658COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25045cd9bd1fbb9eb37b2c4f7b0e3eef78b232e589b3e3abc8669e2073ab4292
Instruction ID: 20fc849cc166026881c648035130be825c9fa125a40b1d1c53d41179c6e62492
Opcode Fuzzy Hash: 25045cd9bd1fbb9eb37b2c4f7b0e3eef78b232e589b3e3abc8669e2073ab4292
Instruction Fuzzy Hash: A552E3319083459FCB14CF28C0906AABBE1FF85314F188A6DE8DA5B341D775EA49EF81

Function 00F63A60 Relevance: .6, Instructions: 609COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81d1ad401876752f36dfec5dcb1c9017c3e3ad24bf68ad387cd10159fa71816
Instruction ID: 69f8ee24bd47a0b139b32453e305da2858166ba039512bde53ae8793d0c47637
Opcode Fuzzy Hash: c81d1ad401876752f36dfec5dcb1c9017c3e3ad24bf68ad387cd10159fa71816
Instruction Fuzzy Hash: E2422471914B208FC368CF29C590626BBF1BF95710B604A2ED6A787F90D736F985EB10

Function 00F9FFD0 Relevance: .6, Instructions: 553COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd8f08a2e7315344d1e5f27a77d2a63026e39f1cb8123a0a7adfdca88098175
Instruction ID: e4f9880b3440477259629b0c87d9c34286b5602d8d89d91839824236d12e4f42
Opcode Fuzzy Hash: dbd8f08a2e7315344d1e5f27a77d2a63026e39f1cb8123a0a7adfdca88098175
Instruction Fuzzy Hash: 0202F272A082158FC708DF38E89066AB7E2FF8A314F1E897DD98587351D730E955DB82

Function 00FA00A0 Relevance: .6, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d16dc8d6e15a4370efff808064360aee363d6af6a75e642f7faa4410459ed5
Instruction ID: 350b5a88c6c46b3f880814be5a84b66ab51eed274b4c50f7184e1902af0eec2b
Opcode Fuzzy Hash: b7d16dc8d6e15a4370efff808064360aee363d6af6a75e642f7faa4410459ed5
Instruction Fuzzy Hash: 9F020572A182158FC708DF38D89066AB7E2FF8A314F1E897DD48587351EB34E915DB81

Function 00F66090 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b61faf4e7e6893abde7c42b248dd8604cf6245b72464c245c7f3b6eca7ef63
Instruction ID: dcfb794040a269bbd1fce474481bb7afd336a30dff8824c63d7db6dcc7ec4f12
Opcode Fuzzy Hash: 39b61faf4e7e6893abde7c42b248dd8604cf6245b72464c245c7f3b6eca7ef63
Instruction Fuzzy Hash: 62E168716083418FC720DF29C880A6BFBE1EFA8300F48892DE5D587752E775E949DB92

Function 00F78940 Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95428ff0c2c765298b21802dd4644668b4e74235e52a1f5ff2f03633bfeb47da
Instruction ID: 9e2bce0c27708a85d3f0887e7003b7596531160026a8e507347b6acd12c6ee3d
Opcode Fuzzy Hash: 95428ff0c2c765298b21802dd4644668b4e74235e52a1f5ff2f03633bfeb47da
Instruction Fuzzy Hash: B79136B2944314DBD7109F18DC86A7B73B0FF953A0F09852DE88A87391EB35A905E793

Function 00F8F960 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 783f35b9294030e8808b172f2eb6dc9b9642e001875e29002f1dd43ba1cc5154
Instruction ID: 0d58ab72c8db95061138b74de28a1e047a4dac97a36141ebc3e8bf7fae086b9f
Opcode Fuzzy Hash: 783f35b9294030e8808b172f2eb6dc9b9642e001875e29002f1dd43ba1cc5154
Instruction Fuzzy Hash: 890205F0A15B009FC399CF28D8557A7BBE9FB4E744F10496EE0AE87351CBB125029B52

Function 00F66C10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 480b8282a10723de27e3d8fd6ff7c3c19139952345531e61b0001403412cddcd
Instruction ID: e1f8b22ca4f1a48e9a0b1dba36618a4006b446543ac87eefc10e83d5614a6634
Opcode Fuzzy Hash: 480b8282a10723de27e3d8fd6ff7c3c19139952345531e61b0001403412cddcd
Instruction Fuzzy Hash: 3FC158B2A587418FC360CF68DC86BABB7F1BF85318F08492DD1D9C6242E778A155CB46

Function 00F7F090 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74dad012f19eae07a1eeed71a55aff6d390cade9fa16b65d71a7b8270e46b23c
Instruction ID: cc7fb1ae64fa3b4135a3dde4285c69e907eac6094cf6f08350818ed2c3bddba3
Opcode Fuzzy Hash: 74dad012f19eae07a1eeed71a55aff6d390cade9fa16b65d71a7b8270e46b23c
Instruction Fuzzy Hash: 9C812976E042614FCB11CE28C89075ABBD1AB85334F19C27ED8A99B3D2D674DC49E3D2

Function 00F8A3F0 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 751a0a88d242470cf360c565d55157dc930afe7a0e5ddd1442814def1b9a693a
Instruction ID: 3984a0db2cf25f863e1e14d21c7a0930ba68ff3e66365c8ab048aa9cb613ebf7
Opcode Fuzzy Hash: 751a0a88d242470cf360c565d55157dc930afe7a0e5ddd1442814def1b9a693a
Instruction Fuzzy Hash: 0E910F7160C3558FD328DF28D8817AFBBE1EBC5304F05892DE4A59B281DBB488069BD3

Function 00F9BB70 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9268fe464e255dc1695fd91ee15c5f9084f674511b8dd97d52b31718f9e95081
Instruction ID: 29dc6687ff8963b5555926721ad1ba4190a559febc859bc0e0e104e7d2e88c83
Opcode Fuzzy Hash: 9268fe464e255dc1695fd91ee15c5f9084f674511b8dd97d52b31718f9e95081
Instruction Fuzzy Hash: F95159756083088FEF28EF24E955B3BB7E1EB81710F14883DD98587391EB359C15A781

Function 0105EA3C Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008ad538a3b5ab225157a627707a9643d91084c0960b864fcb0cab4b20d3dba8
Instruction ID: 3cdf5b08189fb7f2edbd1e690d0537d15f3e837eefa0a32f9c305f03382a70a2
Opcode Fuzzy Hash: 008ad538a3b5ab225157a627707a9643d91084c0960b864fcb0cab4b20d3dba8
Instruction Fuzzy Hash: A75126F3A483085BE3006D7EECC8767BACAEB94324F2A863D9794C3784EC7999054251

Function 00F98710 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0883c5799ce58fee53c7c8610b04c17795a417b6ee5abdf55466a0a450cf92a9
Instruction ID: d2bb77918aeeb0e371cb2bb1243c713b811155f9178e29de3f256b277bc96acf
Opcode Fuzzy Hash: 0883c5799ce58fee53c7c8610b04c17795a417b6ee5abdf55466a0a450cf92a9
Instruction Fuzzy Hash: FD517DB1A083448FE714DF29D89435BBBE1BBC5358F044E2DE4E987350E779DA088B92

Function 00F69150 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a43474baedd13b0d9d8ce7920c3662142fc8a9a34e14cd720fa28c50937b343
Instruction ID: ec7e8b478d41bef5f8c5d2a4659bc522257db509de4d2ac15b171138e3cdd3a0
Opcode Fuzzy Hash: 3a43474baedd13b0d9d8ce7920c3662142fc8a9a34e14cd720fa28c50937b343
Instruction Fuzzy Hash: 0231D533E215114BE714CA65CC043963297DBD9328F3E86B8C425DB296C97B9D0386C0

Function 00F6ADE0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 775dec5c206e14611ce0a0f506742ba716e9a87ed37007d6d3f1d841dae762cc
Instruction ID: 5db9e12ac7e4ffd494ea007f302e527dabeef0120ba889e444c6389cf6e90a61
Opcode Fuzzy Hash: 775dec5c206e14611ce0a0f506742ba716e9a87ed37007d6d3f1d841dae762cc
Instruction Fuzzy Hash: B631E6A3B1866207D718CE38992137BABD29BD1B04F18493DD5D7EB7C4C528CE098B97

Function 00F61F50 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5a5d1427389668793eb2184808c6612ea255da26e82feb4f43e5749824597d3
Instruction ID: bf04b1174394a76579fc4044d3a33032a3390f21713e41ec5ca6d072dae70e8d
Opcode Fuzzy Hash: d5a5d1427389668793eb2184808c6612ea255da26e82feb4f43e5749824597d3
Instruction Fuzzy Hash: 4C318471A082019BD7149E19C880A36B7E1FF89368F1C8A2DF899DB351D735DC52EB82

Function 00FECAD4 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 448de9bffe305816d6971f5a9ae465ec68ca62bf0eeed9303c062186b15838fd
Instruction ID: 5b7b274255e4a970ebe17a4e25fde74c828345445a1af65f2c5f5cbe4e8b012d
Opcode Fuzzy Hash: 448de9bffe305816d6971f5a9ae465ec68ca62bf0eeed9303c062186b15838fd
Instruction Fuzzy Hash: 0B31D0B3A146004BF750AE3DDC8836B77D2EBC8310F1A853CCB8497B88D979AD058786

Function 00F6A874 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 709649ac3b9751c91b4ad5ba75df50ebeef24aa5efa0ae655b1f8524cce4462c
Instruction ID: 5f09c9f95f2256433e64986075d53a7987b3ea84acb0b08b267ba3934246e392
Opcode Fuzzy Hash: 709649ac3b9751c91b4ad5ba75df50ebeef24aa5efa0ae655b1f8524cce4462c
Instruction Fuzzy Hash: F83187B15483849FD308DF26D85126ABBA1FBD2344F145D0DE0D69B324DB75C14ACF86

Function 00F62CC0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0036200552033f5b6d28a228863a0eee9d85c3b3d6c42048e375acd45fee40ed
Instruction ID: 3fa5150ee2d25bf4564a15c735390071b0a7952573b2c25b478d31b09863cfe5
Opcode Fuzzy Hash: 0036200552033f5b6d28a228863a0eee9d85c3b3d6c42048e375acd45fee40ed
Instruction Fuzzy Hash: 6F11E777F29A2647E3D0CE7ADCD461A7352EBC632070A0535EE41D7382C666E811F190

Function 00F9BF10 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3787664373.0000000000F61000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.3787641084.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787664373.0000000000FA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000113B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001217000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.000000000123C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001245000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787722410.0000000001254000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3787969457.0000000001255000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788076458.00000000013EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3788092854.00000000013EB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f497e5136f504a17261a31680727b22034e1519a3885c564d17e6f6fb3a01222
Instruction ID: 8062c2da0c2584a979e9b3f5ea4f065304af34b27706ff3f5f1fe58616c16290
Opcode Fuzzy Hash: f497e5136f504a17261a31680727b22034e1519a3885c564d17e6f6fb3a01222
Instruction Fuzzy Hash: 86116F72B152144BFB149E98EE8062A7763EFC6719F2D8069D8841B219E7358C0167D1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
file.exe

Function 00F6BDB0 Relevance: 7.6, Strings: 6, Instructions: 101
COMMON

Function 00F9E470 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 00F68F20 Relevance: .2, Instructions: 178
COMMON

Function 00F9BAB0 Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Function 00F84800 Relevance: 16.8, Strings: 13, Instructions: 508
COMMON

Function 00F82BA0 Relevance: 13.1, Strings: 10, Instructions: 644
COMMON

Function 01125BAA Relevance: 12.9, Strings: 9, Instructions: 1601
COMMON

Function 0112C59E Relevance: 11.6, Strings: 8, Instructions: 1630
COMMON