Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1560426
MD5:	6380b8ca2f9bfc1d86617a3a7fd924f1
SHA1:	04ff7e660a59bd2c45098e99a3fd5bff614d2d57
SHA256:	f7b7694decac18c856b37c68c8486eccd09470ec28c7f92d90f5f0905110eb7c
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6408 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 6380B8CA2F9BFC1D86617A3A7FD924F1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["p10tgrace.sbs", "processhol.sbs", "3xp3cts1aim.sbs", "p3ar11fter.sbs", "peepburry828.sbs"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T19:57:01.063780+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	104.21.66.38	443	TCP
2024-11-21T19:57:03.173261+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.66.38	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T19:57:01.802442+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	104.21.66.38	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T19:57:01.802442+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	104.21.66.38	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T19:57:01.063780+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	104.21.66.38	443	TCP
2024-11-21T19:57:03.173261+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	49731	104.21.66.38	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T19:56:59.191822+0100	2057730	1	Domain Observed Used for C2 Detected	192.168.2.4	54395	1.1.1.1	53	UDP

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cook-rain.sbs

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: cook-rain.sbs

Source: unknown

Source: file.exe, 00000000.00000003.1732682281.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1732013708.000000000127A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: file.exe, 00000000.00000002.1734316733.00000000012D1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1732682281.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1732013708.000000000127A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: file.exe, 00000000.00000002.1734316733.00000000012D1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1732682281.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1732013708.000000000127A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/Q
Source: file.exe, 00000000.00000003.1732013708.000000000127A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: file.exe, 00000000.00000002.1734132839.000000000129B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1732013708.000000000127A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api%
Source: file.exe, 00000000.00000003.1732682281.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733073508.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1734316733.00000000012D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiOn
Source: file.exe, 00000000.00000002.1734132839.0000000001262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1732013708.0000000001262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/api-

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 104.21.66.38:443 -> 192.168.2.4:49730 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00989030	0_2_00989030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009589A0	0_2_009589A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095CF05	0_2_0095CF05
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098F8D0	0_2_0098F8D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095E0D8	0_2_0095E0D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009598F0	0_2_009598F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098B8E0	0_2_0098B8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836	0_2_00B1C836
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAD864	0_2_00AAD864
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00956840	0_2_00956840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098C040	0_2_0098C040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00970870	0_2_00970870
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009561A0	0_2_009561A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009841D0	0_2_009841D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B141FF	0_2_00B141FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095E970	0_2_0095E970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B192F9	0_2_00B192F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00954AC0	0_2_00954AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1E2E7	0_2_00B1E2E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00955AC9	0_2_00955AC9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00959210	0_2_00959210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095B210	0_2_0095B210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A03A35	0_2_00A03A35
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABEA6D	0_2_00ABEA6D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00952B80	0_2_00952B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4E3B8	0_2_00A4E3B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B9B3D4	0_2_00B9B3D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B22338	0_2_00B22338
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0096DB30	0_2_0096DB30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0096FB60	0_2_0096FB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00955C90	0_2_00955C90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA74BA	0_2_00AA74BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00990C80	0_2_00990C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00978CB0	0_2_00978CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009594D0	0_2_009594D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00956CC0	0_2_00956CC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009824E0	0_2_009824E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A02C38	0_2_00A02C38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095542C	0_2_0095542C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B15C78	0_2_00B15C78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00953580	0_2_00953580
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00991580	0_2_00991580
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A58D26	0_2_00A58D26
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACC52A	0_2_00ACC52A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095AD00	0_2_0095AD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00969530	0_2_00969530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00973D70	0_2_00973D70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C156C	0_2_009C156C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00975E90	0_2_00975E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0F6B0	0_2_00A0F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F0E1A	0_2_009F0E1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00977E20	0_2_00977E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00970650	0_2_00970650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00971790	0_2_00971790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098C780	0_2_0098C780
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009887B0	0_2_009887B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009DEFA3	0_2_009DEFA3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009527D0	0_2_009527D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009577D0	0_2_009577D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA4FF6	0_2_00AA4FF6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00978770	0_2_00978770
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00990F60	0_2_00990F60

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9994748975409836
Source: file.exe	Static PE information: Section: nbqdyuoa ZLIB complexity 0.9944721758275129

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009827B0 CoCreateInstance,

0_2_009827B0

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static file information: File size 1858048 > 1048576

Source: file.exe

Static PE information: Raw size of nbqdyuoa is bigger than: 0x100000 < 0x19ba00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.950000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nbqdyuoa:EW;lsjapkzb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nbqdyuoa:EW;lsjapkzb:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cf735 should be: 0x1c5dcc

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: nbqdyuoa
Source: file.exe	Static PE information: section name: lsjapkzb
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C118C3 push esi; mov dword ptr [esp], edx	0_2_00C119C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCB892 push edi; mov dword ptr [esp], ebp	0_2_00BCB94C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCB892 push eax; mov dword ptr [esp], 77FD103Fh	0_2_00BCB96E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B5A085 push esi; mov dword ptr [esp], edi	0_2_00B5A13A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB1887 push ecx; mov dword ptr [esp], ebp	0_2_00BB18A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push ecx; mov dword ptr [esp], 65FF1FC5h	0_2_00B1C840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push 4C1C3400h; mov dword ptr [esp], esi	0_2_00B1C8F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push 36387E8Eh; mov dword ptr [esp], eax	0_2_00B1C98C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push 7CCC3197h; mov dword ptr [esp], ebp	0_2_00B1C994
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push ebp; mov dword ptr [esp], 055F44DDh	0_2_00B1C9BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push 1D3A7904h; mov dword ptr [esp], eax	0_2_00B1C9E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push ecx; mov dword ptr [esp], edx	0_2_00B1CA08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push ebp; mov dword ptr [esp], edi	0_2_00B1CA1E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push edi; mov dword ptr [esp], esi	0_2_00B1CA4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push 13B6DDE1h; mov dword ptr [esp], ebx	0_2_00B1CA5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push 6F4FAB4Fh; mov dword ptr [esp], ebx	0_2_00B1CB0B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push ebx; mov dword ptr [esp], 3EE1B8B1h	0_2_00B1CB89
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push esi; mov dword ptr [esp], ecx	0_2_00B1CC09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push 424BCB50h; mov dword ptr [esp], esi	0_2_00B1CC33
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push esi; mov dword ptr [esp], 66FBA557h	0_2_00B1CC45
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push 1ECA81C6h; mov dword ptr [esp], edx	0_2_00B1CCAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push 4659B167h; mov dword ptr [esp], esp	0_2_00B1CDA1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push 2BBDC888h; mov dword ptr [esp], ecx	0_2_00B1CDD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push 62218F1Eh; mov dword ptr [esp], esi	0_2_00B1CE06
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push 58A5DDAFh; mov dword ptr [esp], ebp	0_2_00B1CE89
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push esi; mov dword ptr [esp], edx	0_2_00B1CEA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push 33EF5F69h; mov dword ptr [esp], eax	0_2_00B1CF35
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push 3BFB41FAh; mov dword ptr [esp], eax	0_2_00B1CF67
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push ebp; mov dword ptr [esp], edx	0_2_00B1CFCA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push 25CC1BA4h; mov dword ptr [esp], ebx	0_2_00B1D01D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C836 push ebx; mov dword ptr [esp], esp	0_2_00B1D024

Source: file.exe	Static PE information: section name: entropy: 7.987246249896705
Source: file.exe	Static PE information: section name: nbqdyuoa entropy: 7.954937787050603

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC962 second address: 9AC971 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB4CD14683Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B213FC second address: B2140D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2140D second address: B2141E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4CD14683Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B284D1 second address: B284DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB4CD3D7AA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B284DB second address: B284F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB4CD14683Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28688 second address: B2868C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B287C1 second address: B287D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD146844h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B287D9 second address: B287E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B287E8 second address: B28812 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB4CD146836h 0x00000008 jmp 00007FB4CD14683Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jng 00007FB4CD146842h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28B63 second address: B28BA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4CD3D7AACh 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FB4CD3D7AB8h 0x00000012 jmp 00007FB4CD3D7AB2h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28E3F second address: B28E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4CD146846h 0x00000009 ja 00007FB4CD146836h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 jmp 00007FB4CD14683Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2A910 second address: B2A9BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD3D7AB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a xor dword ptr [esp], 05E8FB1Dh 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007FB4CD3D7AA8h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b jmp 00007FB4CD3D7AB1h 0x00000030 mov edx, dword ptr [ebp+122D3521h] 0x00000036 push 00000003h 0x00000038 sbb ecx, 589DFA81h 0x0000003e push 00000000h 0x00000040 jc 00007FB4CD3D7AA8h 0x00000046 mov esi, dword ptr [ebp+122D36F1h] 0x0000004c push 00000003h 0x0000004e call 00007FB4CD3D7AB6h 0x00000053 pop edi 0x00000054 call 00007FB4CD3D7AA9h 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007FB4CD3D7AB3h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2A9BE second address: B2AA1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD146843h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FB4CD14683Eh 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007FB4CD146848h 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 push ebx 0x0000001a pushad 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d jl 00007FB4CD146836h 0x00000023 popad 0x00000024 pop ebx 0x00000025 mov eax, dword ptr [eax] 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FB4CD14683Ch 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2AA1D second address: B2AA31 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB4CD3D7AA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2AA31 second address: B2AA65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB4CD146836h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 popad 0x00000012 pop eax 0x00000013 pushad 0x00000014 xor ebx, dword ptr [ebp+122D3791h] 0x0000001a mov dword ptr [ebp+122D186Ah], edi 0x00000020 popad 0x00000021 lea ebx, dword ptr [ebp+1245168Ah] 0x00000027 mov dword ptr [ebp+122D292Dh], ecx 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2AA65 second address: B2AA6B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2AADF second address: B2AAE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2AAE5 second address: B2AB30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jg 00007FB4CD3D7AAEh 0x0000000f nop 0x00000010 mov dword ptr [ebp+122D2925h], edi 0x00000016 push 00000000h 0x00000018 mov dword ptr [ebp+122D1ED4h], edi 0x0000001e call 00007FB4CD3D7AA9h 0x00000023 jmp 00007FB4CD3D7AB6h 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2AB30 second address: B2AB34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2AC33 second address: B2AC3D instructions: 0x00000000 rdtsc 0x00000002 js 00007FB4CD3D7AACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C3A8 second address: B4C3AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C3AD second address: B4C3CC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 ja 00007FB4CD3D7AA6h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB4CD3D7AADh 0x00000011 jnc 00007FB4CD3D7AA6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B22F59 second address: B22F6A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB4CD14683Ch 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A209 second address: B4A228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FB4CD3D7AB1h 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FB4CD3D7AA6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A228 second address: B4A232 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB4CD146836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A4A1 second address: B4A4A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B22F63 second address: B22F6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A627 second address: B4A65D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD3D7AB6h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FB4CD3D7AB6h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A65D second address: B4A677 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4CD146844h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A677 second address: B4A67B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A67B second address: B4A69D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FB4CD146849h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A927 second address: B4A92F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A92F second address: B4A939 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FB4CD146836h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A939 second address: B4A93D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A93D second address: B4A949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A949 second address: B4A94D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A94D second address: B4A962 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB4CD146836h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A962 second address: B4A966 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A966 second address: B4A96F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4ADBF second address: B4ADC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4ADC3 second address: B4ADD2 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB4CD146836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4AF14 second address: B4AF1A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BD5B second address: B4BD61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BEDC second address: B4BEF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD3D7AB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BEF0 second address: B4BF0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FB4CD146849h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BF0F second address: B4BF13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4DA84 second address: B4DA98 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007FB4CD146838h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4DA98 second address: B4DAAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jng 00007FB4CD3D7ACBh 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007FB4CD3D7AA6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4DAAD second address: B4DAC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD14683Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5584A second address: B55854 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB4CD3D7AACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5A783 second address: B5A79E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4CD146847h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5A79E second address: B5A7CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB4CD3D7AABh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FB4CD3D7AB5h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5A7CA second address: B5A7CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B59EB3 second address: B59EB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5C356 second address: B5C37B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FB4CD146836h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xor dword ptr [esp], 6EEF94B0h 0x00000015 mov si, ax 0x00000018 call 00007FB4CD146839h 0x0000001d pushad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5C37B second address: B5C388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnp 00007FB4CD3D7AACh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5C388 second address: B5C392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5C392 second address: B5C39B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5C39B second address: B5C39F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5C39F second address: B5C3FA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007FB4CD3D7AB3h 0x00000010 mov eax, dword ptr [eax] 0x00000012 pushad 0x00000013 jmp 00007FB4CD3D7AAFh 0x00000018 pushad 0x00000019 jg 00007FB4CD3D7AA6h 0x0000001f jmp 00007FB4CD3D7AB4h 0x00000024 popad 0x00000025 popad 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a pushad 0x0000002b pushad 0x0000002c je 00007FB4CD3D7AA6h 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5C3FA second address: B5C413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB4CD146842h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5C532 second address: B5C53C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FB4CD3D7AA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5CAE0 second address: B5CAE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5CAE4 second address: B5CAEE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D0EF second address: B5D0F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D0F4 second address: B5D145 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebx 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007FB4CD3D7AA8h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 mov edi, 0F29D4F1h 0x0000002a nop 0x0000002b jmp 00007FB4CD3D7AB7h 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 push edi 0x00000035 pop edi 0x00000036 push edx 0x00000037 pop edx 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D145 second address: B5D14A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D41E second address: B5D422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D422 second address: B5D426 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D426 second address: B5D45E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FB4CD3D7AB8h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB4CD3D7AB5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D45E second address: B5D462 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D743 second address: B5D7A5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB4CD3D7AA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FB4CD3D7AB7h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007FB4CD3D7AA8h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b push eax 0x0000002c js 00007FB4CD3D7AACh 0x00000032 sub dword ptr [ebp+122D292Dh], edx 0x00000038 pop esi 0x00000039 xchg eax, ebx 0x0000003a jc 00007FB4CD3D7AB4h 0x00000040 pushad 0x00000041 jno 00007FB4CD3D7AA6h 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1C343 second address: B1C34F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB4CD146836h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60BAA second address: B60BB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6031A second address: B60328 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60328 second address: B6032C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60BB0 second address: B60BCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4CD146849h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60BCD second address: B60BD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6032C second address: B60332 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61648 second address: B61651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61651 second address: B6165E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6165E second address: B61662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B62B20 second address: B62B24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B62B24 second address: B62BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FB4CD3D7AA8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ecx 0x00000029 call 00007FB4CD3D7AA8h 0x0000002e pop ecx 0x0000002f mov dword ptr [esp+04h], ecx 0x00000033 add dword ptr [esp+04h], 0000001Dh 0x0000003b inc ecx 0x0000003c push ecx 0x0000003d ret 0x0000003e pop ecx 0x0000003f ret 0x00000040 jmp 00007FB4CD3D7AAEh 0x00000045 xchg eax, ebx 0x00000046 jmp 00007FB4CD3D7AB5h 0x0000004b push eax 0x0000004c pushad 0x0000004d jmp 00007FB4CD3D7AB8h 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B636F8 second address: B636FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B636FC second address: B63727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB4CD3D7AB9h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jbe 00007FB4CD3D7AA6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B64175 second address: B64189 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD146840h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B64189 second address: B6418E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B64A02 second address: B64A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B64A06 second address: B64A0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6952F second address: B695A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD14683Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jc 00007FB4CD146849h 0x00000010 nop 0x00000011 movzx ebx, si 0x00000014 movzx edi, cx 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FB4CD146838h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 mov bx, ax 0x00000036 push 00000000h 0x00000038 pushad 0x00000039 sub dword ptr [ebp+122D2F78h], edx 0x0000003f jmp 00007FB4CD14683Ch 0x00000044 popad 0x00000045 xchg eax, esi 0x00000046 jl 00007FB4CD14683Eh 0x0000004c push ecx 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6B5D0 second address: B6B5D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A7AF second address: B6A7B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6B5D4 second address: B6B5E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FB4CD3D7AA6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6B5E8 second address: B6B5EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6B5EC second address: B6B668 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D1A4Ah], edi 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FB4CD3D7AA8h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a pushad 0x0000002b jnc 00007FB4CD3D7AACh 0x00000031 push ecx 0x00000032 mov dword ptr [ebp+122D1AA3h], eax 0x00000038 pop ecx 0x00000039 popad 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push edx 0x0000003f call 00007FB4CD3D7AA8h 0x00000044 pop edx 0x00000045 mov dword ptr [esp+04h], edx 0x00000049 add dword ptr [esp+04h], 00000015h 0x00000051 inc edx 0x00000052 push edx 0x00000053 ret 0x00000054 pop edx 0x00000055 ret 0x00000056 movsx ebx, si 0x00000059 push eax 0x0000005a pushad 0x0000005b jbe 00007FB4CD3D7AA8h 0x00000061 push edi 0x00000062 pop edi 0x00000063 push eax 0x00000064 push edx 0x00000065 js 00007FB4CD3D7AA6h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6C72A second address: B6C7B2 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB4CD14683Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FB4CD146838h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 movsx ebx, dx 0x0000002a call 00007FB4CD146843h 0x0000002f mov ebx, dword ptr [ebp+122D3751h] 0x00000035 pop edi 0x00000036 mov ebx, dword ptr [ebp+122D37F5h] 0x0000003c push 00000000h 0x0000003e mov dword ptr [ebp+122D184Dh], eax 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push edi 0x00000049 call 00007FB4CD146838h 0x0000004e pop edi 0x0000004f mov dword ptr [esp+04h], edi 0x00000053 add dword ptr [esp+04h], 00000015h 0x0000005b inc edi 0x0000005c push edi 0x0000005d ret 0x0000005e pop edi 0x0000005f ret 0x00000060 mov dword ptr [ebp+122D28B5h], ecx 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6C7B2 second address: B6C7C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4CD3D7AADh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6B895 second address: B6B89F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push esi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6C7C4 second address: B6C7C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6C7C9 second address: B6C7CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6F7A8 second address: B6F7B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6F7B1 second address: B6F7B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6E922 second address: B6E945 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB4CD3D7AB9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B718B3 second address: B718FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 nop 0x00000007 mov ebx, eax 0x00000009 push 00000000h 0x0000000b and ebx, dword ptr [ebp+122D3785h] 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FB4CD146838h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d push eax 0x0000002e pushad 0x0000002f jmp 00007FB4CD146840h 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B728A0 second address: B728C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB4CD3D7AB9h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B728C2 second address: B728CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B728CC second address: B728D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B728D0 second address: B72957 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FB4CD146838h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 or bh, FFFFFFFBh 0x00000025 mov edi, dword ptr [ebp+122D2EF2h] 0x0000002b push 00000000h 0x0000002d jmp 00007FB4CD146844h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007FB4CD146838h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e mov dword ptr [ebp+122D3278h], edx 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007FB4CD146843h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B72957 second address: B7295C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B73B08 second address: B73B0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B73B0E second address: B73B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B719F6 second address: B719FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71AE8 second address: B71AEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71AEC second address: B71AF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71AF6 second address: B71AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B749C0 second address: B749C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B73C03 second address: B73C09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B73C09 second address: B73C0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B73C0E second address: B73C14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70B8F second address: B70B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B73C14 second address: B73CBB instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB4CD3D7AA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FB4CD3D7AA8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 push dword ptr fs:[00000000h] 0x00000030 sub ebx, dword ptr [ebp+12480356h] 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d mov dword ptr [ebp+122D1D36h], edi 0x00000043 mov dword ptr [ebp+122D1969h], edi 0x00000049 mov eax, dword ptr [ebp+122D0E21h] 0x0000004f push 00000000h 0x00000051 push ebx 0x00000052 call 00007FB4CD3D7AA8h 0x00000057 pop ebx 0x00000058 mov dword ptr [esp+04h], ebx 0x0000005c add dword ptr [esp+04h], 00000014h 0x00000064 inc ebx 0x00000065 push ebx 0x00000066 ret 0x00000067 pop ebx 0x00000068 ret 0x00000069 movzx edi, bx 0x0000006c mov ebx, dword ptr [ebp+122D3761h] 0x00000072 push FFFFFFFFh 0x00000074 push esi 0x00000075 jnl 00007FB4CD3D7ABBh 0x0000007b pop ebx 0x0000007c nop 0x0000007d jnp 00007FB4CD3D7AB0h 0x00000083 pushad 0x00000084 pushad 0x00000085 popad 0x00000086 push eax 0x00000087 push edx 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74C4B second address: B74C51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75B24 second address: B75B2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FB4CD3D7AA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74C51 second address: B74C55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75B2E second address: B75B32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74C55 second address: B74C59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77A1E second address: B77A24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75B32 second address: B75B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74C59 second address: B74C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75B43 second address: B75B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75B49 second address: B75C07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov edi, dword ptr [ebp+122D3755h] 0x0000000d push dword ptr fs:[00000000h] 0x00000014 mov ebx, dword ptr [ebp+122D354Dh] 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 call 00007FB4CD3D7AADh 0x00000026 mov ebx, 1153C046h 0x0000002b pop ebx 0x0000002c mov eax, dword ptr [ebp+122D14B9h] 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007FB4CD3D7AA8h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 0000001Bh 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c mov dword ptr [ebp+1248285Ch], esi 0x00000052 push FFFFFFFFh 0x00000054 push 00000000h 0x00000056 push ecx 0x00000057 call 00007FB4CD3D7AA8h 0x0000005c pop ecx 0x0000005d mov dword ptr [esp+04h], ecx 0x00000061 add dword ptr [esp+04h], 00000016h 0x00000069 inc ecx 0x0000006a push ecx 0x0000006b ret 0x0000006c pop ecx 0x0000006d ret 0x0000006e jmp 00007FB4CD3D7AABh 0x00000073 nop 0x00000074 jnc 00007FB4CD3D7ABBh 0x0000007a push eax 0x0000007b push eax 0x0000007c push edx 0x0000007d jmp 00007FB4CD3D7AB1h 0x00000082 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75C07 second address: B75C16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB4CD14683Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F116 second address: B7F11B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F28A second address: B7F290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F290 second address: B7F294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F294 second address: B7F2A4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jnc 00007FB4CD146836h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F2A4 second address: B7F2AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1726E second address: B1728C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jmp 00007FB4CD146840h 0x0000000b jg 00007FB4CD146836h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1728C second address: B17291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8B808 second address: B8B813 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push edi 0x00000006 pop edi 0x00000007 pop esi 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8B813 second address: B8B82F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB4CD3D7AAEh 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C196 second address: B8C19A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C19A second address: B8C1A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C1A0 second address: B8C1AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C1AA second address: B8C1E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD3D7AAFh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FB4CD3D7AAFh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FB4CD3D7AB0h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C1E3 second address: B8C1FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD14683Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C1FB second address: B8C200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C36D second address: B8C3B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007FB4CD146842h 0x0000000b jmp 00007FB4CD14683Bh 0x00000010 popad 0x00000011 jl 00007FB4CD146853h 0x00000017 jmp 00007FB4CD146847h 0x0000001c jp 00007FB4CD146836h 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C3B8 second address: B8C3BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C3BC second address: B8C3D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c jmp 00007FB4CD14683Fh 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C3D8 second address: B8C3DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C3DD second address: B8C3E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9021E second address: B90226 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B90226 second address: B9022A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B157F0 second address: B15806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FB4CD3D7AB1h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15806 second address: B15820 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jnl 00007FB4CD146836h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jo 00007FB4CD146836h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9BCE1 second address: B9BCF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push ebx 0x00000008 jc 00007FB4CD3D7AA6h 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F928 second address: B1F92E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9AAA0 second address: B9AAC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB4CD3D7AB6h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push edi 0x00000010 pop edi 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9AC6C second address: B9AC70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9AC70 second address: B9AC74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9AC74 second address: B9AC90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB4CD146843h 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9AF6E second address: B9AF74 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9B0C2 second address: B9B0C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9B0C6 second address: B9B0CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9B20F second address: B9B22D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD146842h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9B22D second address: B9B231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9B231 second address: B9B237 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9B237 second address: B9B243 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 ja 00007FB4CD3D7AA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9B365 second address: B9B369 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9B369 second address: B9B372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9BB69 second address: B9BB73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB4CD146836h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9BB73 second address: B9BBA6 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB4CD3D7AA6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FB4CD3D7AB6h 0x00000011 pushad 0x00000012 jmp 00007FB4CD3D7AACh 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9A4BA second address: B9A4F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD14683Dh 0x00000007 jmp 00007FB4CD146849h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f jnp 00007FB4CD146852h 0x00000015 pushad 0x00000016 je 00007FB4CD146836h 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA0803 second address: BA0813 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB4CD3D7AA6h 0x00000008 jo 00007FB4CD3D7AA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA0813 second address: BA0818 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA09DF second address: BA09E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA09E5 second address: BA09FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB4CD146840h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA09FC second address: BA0A00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA0E14 second address: BA0E1E instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB4CD146836h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA0E1E second address: BA0E24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA0512 second address: BA0521 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA0521 second address: BA053E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD3D7AB7h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA1245 second address: BA126C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD14683Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c ja 00007FB4CD146836h 0x00000012 jmp 00007FB4CD14683Ch 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA13D2 second address: BA13D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA1857 second address: BA1860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA61CF second address: BA61E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4CD3D7AAFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA61E2 second address: BA6204 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD146848h 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007FB4CD146836h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B653F8 second address: B653FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B653FC second address: B65406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65406 second address: B6540A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6540A second address: B6540E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B658B5 second address: B658B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65979 second address: B6597F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6597F second address: B659BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007FB4CD3D7AA8h 0x0000000b popad 0x0000000c xor dword ptr [esp], 660C03EEh 0x00000013 jng 00007FB4CD3D7AA7h 0x00000019 cmc 0x0000001a mov dword ptr [ebp+122D293Ch], esi 0x00000020 push FF31CC08h 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FB4CD3D7AB4h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66210 second address: B66216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66216 second address: B66268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov di, dx 0x0000000c push 0000001Eh 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FB4CD3D7AA8h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 or edi, dword ptr [ebp+122D2F15h] 0x0000002e nop 0x0000002f jmp 00007FB4CD3D7AB6h 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push edi 0x00000038 push ecx 0x00000039 pop ecx 0x0000003a pop edi 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66357 second address: B6635C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6635C second address: B66361 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66560 second address: B66565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66565 second address: B665C8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b add dword ptr [ebp+122D2F10h], esi 0x00000011 lea eax, dword ptr [ebp+1248BFF6h] 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007FB4CD3D7AA8h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 call 00007FB4CD3D7AADh 0x00000036 jmp 00007FB4CD3D7AB1h 0x0000003b pop ecx 0x0000003c nop 0x0000003d je 00007FB4CD3D7AB2h 0x00000043 jc 00007FB4CD3D7AACh 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA547A second address: BA5480 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA5480 second address: BA548E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FB4CD3D7AA6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA55D4 second address: BA55DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB4CD146836h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA55DE second address: BA55FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD3D7AADh 0x00000007 jnc 00007FB4CD3D7AA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnc 00007FB4CD3D7AA6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA55FD second address: BA5614 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD146843h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA573D second address: BA5751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007FB4CD3D7AACh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA589E second address: BA58A4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA58A4 second address: BA58B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA58B3 second address: BA58C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4CD14683Eh 0x00000009 pop edi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA59FE second address: BA5A39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD3D7AB2h 0x00000007 jmp 00007FB4CD3D7AB9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jne 00007FB4CD3D7AACh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA5B72 second address: BA5B78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA5B78 second address: BA5B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA5CDA second address: BA5CDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA5CDE second address: BA5CE8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA5CE8 second address: BA5CEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA5CEE second address: BA5CF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA85EC second address: BA860E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB4CD146842h 0x00000008 jmp 00007FB4CD14683Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA860E second address: BA863B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jc 00007FB4CD3D7AA6h 0x0000000e jmp 00007FB4CD3D7AB4h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA863B second address: BA863F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA863F second address: BA8662 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB4CD3D7AA6h 0x00000008 js 00007FB4CD3D7AA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB4CD3D7AAFh 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA8662 second address: BA8668 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA817E second address: BA8182 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA8182 second address: BA818B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA818B second address: BA8190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA8190 second address: BA8196 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA8196 second address: BA819A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA819A second address: BA81B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FB4CD14683Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB0B39 second address: BB0B45 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB4CD3D7AA6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB0B45 second address: BB0B52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FB4CD146836h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB0B52 second address: BB0B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB0B5A second address: BB0B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FB4CD146836h 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e push ebx 0x0000000f jng 00007FB4CD146836h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB0C9E second address: BB0CA3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB0CA3 second address: BB0CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jno 00007FB4CD146842h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jnc 00007FB4CD146836h 0x00000018 je 00007FB4CD146836h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB0E9E second address: BB0EA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB0EA2 second address: BB0EBE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB4CD146836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jg 00007FB4CD146836h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pushad 0x00000014 popad 0x00000015 jo 00007FB4CD146836h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB0EBE second address: BB0EE8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB4CD3D7AACh 0x00000008 jg 00007FB4CD3D7AA6h 0x0000000e pushad 0x0000000f jnp 00007FB4CD3D7AA6h 0x00000015 jmp 00007FB4CD3D7AB3h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1178 second address: BB1181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1181 second address: BB1186 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB1186 second address: BB11B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4CD146845h 0x00000009 jmp 00007FB4CD146845h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB11B6 second address: BB11E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 js 00007FB4CD3D7AA6h 0x0000000c pushad 0x0000000d popad 0x0000000e jo 00007FB4CD3D7AA6h 0x00000014 ja 00007FB4CD3D7AA6h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jnc 00007FB4CD3D7AACh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66094 second address: B66098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66098 second address: B660FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD3D7AAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007FB4CD3D7AA8h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 mov edi, ecx 0x00000028 mov ch, F6h 0x0000002a jmp 00007FB4CD3D7AB3h 0x0000002f push 00000004h 0x00000031 mov dword ptr [ebp+12453884h], ecx 0x00000037 nop 0x00000038 js 00007FB4CD3D7ABCh 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FB4CD3D7AAEh 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB14DC second address: BB14F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4CD146843h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB14F5 second address: BB14F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB14F9 second address: BB14FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB209E second address: BB20B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FB4CD3D7AAFh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB20B5 second address: BB20CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4CD14683Fh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB20CD second address: BB20D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB20D3 second address: BB20D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6446 second address: BB6451 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FB4CD3D7AA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6813 second address: BB682F instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB4CD146846h 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6AE4 second address: BB6AEE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB4CD3D7AA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA1D0 second address: BBA1DA instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB4CD146836h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA1DA second address: BBA1E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA1E0 second address: BBA209 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FB4CD146836h 0x00000009 jl 00007FB4CD146836h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB4CD146845h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB98E8 second address: BB98EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB98EF second address: BB9911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push esi 0x00000008 jg 00007FB4CD146836h 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FB4CD14683Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9911 second address: BB991B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB4CD3D7AA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9A5C second address: BB9A80 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jc 00007FB4CD146836h 0x0000000d pop ecx 0x0000000e popad 0x0000000f pushad 0x00000010 jns 00007FB4CD14683Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9A80 second address: BB9A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9A84 second address: BB9AA0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FB4CD146841h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9ED4 second address: BB9EF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB4CD3D7AA6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f jmp 00007FB4CD3D7AB3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC0CC6 second address: BC0CCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC0FF2 second address: BC0FF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC0FF8 second address: BC0FFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC15B4 second address: BC15E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FB4CD3D7AB9h 0x0000000c jl 00007FB4CD3D7AA6h 0x00000012 popad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC15E2 second address: BC1608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007FB4CD146850h 0x00000010 jmp 00007FB4CD146844h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC1608 second address: BC161C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4CD3D7AB0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC18B4 second address: BC18B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC1E4A second address: BC1E6D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB4CD3D7AAEh 0x00000008 jns 00007FB4CD3D7AA6h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB4CD3D7AAFh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC1E6D second address: BC1E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC23C0 second address: BC23C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC26C9 second address: BC26DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB4CD146836h 0x0000000a pop eax 0x0000000b jo 00007FB4CD14683Eh 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC5D18 second address: BC5D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6270 second address: BC6275 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC63DB second address: BC6410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 je 00007FB4CD3D7AA6h 0x0000000b jne 00007FB4CD3D7AA6h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jno 00007FB4CD3D7AC0h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC653C second address: BC655B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD146846h 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD428F second address: BD42E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD3D7AABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FB4CD3D7AAEh 0x0000000f popad 0x00000010 pushad 0x00000011 jno 00007FB4CD3D7ACBh 0x00000017 pushad 0x00000018 jl 00007FB4CD3D7AA6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD25BB second address: BD25BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD25BF second address: BD25CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007FB4CD3D7AA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD2B91 second address: BD2B9B instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB4CD146836h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD2B9B second address: BD2BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 ja 00007FB4CD3D7AAEh 0x0000000e push edx 0x0000000f je 00007FB4CD3D7AA6h 0x00000015 pop edx 0x00000016 jmp 00007FB4CD3D7AAFh 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FB4CD3D7AB0h 0x00000022 jmp 00007FB4CD3D7AB2h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD2BEC second address: BD2BF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD2D11 second address: BD2D15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD312E second address: BD3141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jp 00007FB4CD146836h 0x0000000c popad 0x0000000d pop esi 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD32A5 second address: BD32AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD32AC second address: BD32CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007FB4CD14683Ah 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD2042 second address: BD2050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 js 00007FB4CD3D7AA6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD2050 second address: BD207D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB4CD146836h 0x0000000a popad 0x0000000b pop edi 0x0000000c pushad 0x0000000d jmp 00007FB4CD146841h 0x00000012 ja 00007FB4CD14683Ch 0x00000018 ja 00007FB4CD146836h 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD207D second address: BD2083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC096 second address: BDC09C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC09C second address: BDC0A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC0A0 second address: BDC0BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4CD146845h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC0BB second address: BDC0C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC0C1 second address: BDC10E instructions: 0x00000000 rdtsc 0x00000002 js 00007FB4CD146836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007FB4CD146865h 0x00000010 jmp 00007FB4CD146847h 0x00000015 jmp 00007FB4CD146848h 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FB4CD14683Ah 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDBCAA second address: BDBCC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD3D7AB5h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDBE3C second address: BDBE40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEA54B second address: BEA555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB4CD3D7AA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEE3FF second address: BEE429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4CD146849h 0x00000009 push edi 0x0000000a pop edi 0x0000000b jbe 00007FB4CD146836h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEE429 second address: BEE42D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEE42D second address: BEE431 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD4ED second address: BFD520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4CD3D7AB8h 0x00000009 pop edx 0x0000000a pushad 0x0000000b jmp 00007FB4CD3D7AB3h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD520 second address: BFD526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD3C6 second address: BFD3CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0705E second address: C07062 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C07062 second address: C0707D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB4CD3D7AB3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C059E4 second address: C05A05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FB4CD146847h 0x0000000b popad 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C05F88 second address: C05FA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4CD3D7AB3h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C05FA1 second address: C05FAB instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB4CD146836h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C06276 second address: C0628B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB4CD3D7AADh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0628B second address: C0628F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0628F second address: C06299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C06299 second address: C062A3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB4CD146836h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0A9A9 second address: C0A9AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0A9AD second address: C0A9CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB4CD146849h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0A9CC second address: C0A9DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4CD3D7AADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0A578 second address: C0A584 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0A6F3 second address: C0A6FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB4CD3D7AA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0A6FE second address: C0A70F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FB4CD14683Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0A70F second address: C0A71C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C178B3 second address: C178B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C178B7 second address: C178BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C178BB second address: C178C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C14C71 second address: C14CAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB4CD3D7AB2h 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007FB4CD3D7AAAh 0x00000014 jp 00007FB4CD3D7AB2h 0x0000001a push eax 0x0000001b push edx 0x0000001c push esi 0x0000001d pop esi 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C14CAF second address: C14CB9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB4CD146836h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C26E44 second address: C26E50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007FB4CD3D7AA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29AD6 second address: C29AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jc 00007FB4CD14683Ah 0x0000000b push edi 0x0000000c pop edi 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C296A0 second address: C296A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29813 second address: C2981F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnl 00007FB4CD146836h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3E6BC second address: C3E6C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007FB4CD3D7AACh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3E6C9 second address: C3E6CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3E6CD second address: C3E6D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FB4CD3D7AA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3E841 second address: C3E877 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4CD146843h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB4CD146843h 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jg 00007FB4CD146836h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3E877 second address: C3E87D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3EA23 second address: C3EA37 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jo 00007FB4CD146836h 0x00000009 jp 00007FB4CD146836h 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3EA37 second address: C3EA3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3EBBC second address: C3EBC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F03A second address: C3F040 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F040 second address: C3F044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F16A second address: C3F186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB4CD3D7AB5h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F2CF second address: C3F2D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40EA1 second address: C40EA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C43C43 second address: C43C82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB4CD146841h 0x00000008 jnl 00007FB4CD146836h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 or edx, dword ptr [ebp+122D3891h] 0x0000001a push 00000004h 0x0000001c pushad 0x0000001d mov dword ptr [ebp+122D30ECh], esi 0x00000023 sbb di, 294Dh 0x00000028 popad 0x00000029 push BC0C3B9Dh 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 push esi 0x00000032 pop esi 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C43E8A second address: C43E97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jo 00007FB4CD3D7AACh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C43E97 second address: C43EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ebx 0x00000007 jo 00007FB4CD146838h 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 nop 0x00000011 sub dx, 4B68h 0x00000016 movsx edx, di 0x00000019 push dword ptr [ebp+122D1DA6h] 0x0000001f or dh, 0000000Bh 0x00000022 jmp 00007FB4CD146846h 0x00000027 push 5584F5D3h 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FB4CD146848h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C43EEE second address: C43EF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C48B50 second address: C48B7B instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB4CD146836h 0x00000008 ja 00007FB4CD146836h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FB4CD146846h 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C48B7B second address: C48B84 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C48B84 second address: C48B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9AC9B2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9AA42A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B65498 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9AC90A instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6752	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6772	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, file.exe, 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.1732013708.0000000001249000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1734132839.0000000001249000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: file.exe, 00000000.00000002.1734132839.000000000127A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1732013708.000000000127A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0098DF70 LdrInitializeThunk,

0_2_0098DF70

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: p3ar11fter.sbs
Source: file.exe	String found in binary or memory: 3xp3cts1aim.sbs
Source: file.exe	String found in binary or memory: p10tgrace.sbs
Source: file.exe	String found in binary or memory: peepburry828.sbs
Source: file.exe	String found in binary or memory: processhol.sbs

Source: file.exe, file.exe, 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: +Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	223 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://cook-rain.sbs/apiOn	100%	Avira URL Cloud	malware
https://cook-rain.sbs:443/api-	100%	Avira URL Cloud	malware
https://cook-rain.sbs/Q	100%	Avira URL Cloud	malware
https://cook-rain.sbs/api%	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cook-rain.sbs	104.21.66.38	true	false		high

Contacted URLs

Name	Malicious	Reputation
p10tgrace.sbs	false	high
p3ar11fter.sbs	false	high
https://cook-rain.sbs/api	false	high
peepburry828.sbs	false	high
processhol.sbs	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://cook-rain.sbs/	file.exe, 00000000.00000002.1734316733.00000000012D1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1732682281.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1732013708.000000000127A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/api%	file.exe, 00000000.00000002.1734132839.000000000129B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1732013708.000000000127A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cook-rain.sbs/apiOn	file.exe, 00000000.00000003.1732682281.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1733073508.00000000012D4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1734316733.00000000012D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.micro	file.exe, 00000000.00000003.1732682281.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1732013708.000000000127A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/Q	file.exe, 00000000.00000002.1734316733.00000000012D1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1732682281.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1732013708.000000000127A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cook-rain.sbs:443/api-	file.exe, 00000000.00000002.1734132839.0000000001262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1732013708.0000000001262000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.66.38	cook-rain.sbs	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560426
Start date and time:	2024-11-21 19:56:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:57:00	API Interceptor	2x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.66.38	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	Loader.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cook-rain.sbs	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.66.38
	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	injector V2.4.exe	Get hash	malicious	LummaC	Browse	172.67.155.248
	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.66.38
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	ADZ Laucher.exe	Get hash	malicious	LummaC	Browse	172.67.155.248
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Status Update DXLG.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	DHzscd9uqT.exe	Get hash	malicious	STRRAT	Browse	104.20.3.235
	http://bc1qcr8muz00d2v7uqg5ggulrmm.com	Get hash	malicious	Unknown	Browse	104.21.5.242
	https://www.google.com/url?sa=https://r20.rs6.net/tns.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/d7TO.ifvxdvrhe.ru%2FDflmD%2F	Get hash	malicious	Unknown	Browse	104.17.25.14
	scam.html	Get hash	malicious	Unknown	Browse	172.67.200.84
	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	https://bafkreifkijr4deqnzixvigwgbpmegtl7w7z65bwaf2xegf6wb5oejvy7je.ipfs.flk-ipfs.xyz/#mail@andrejsmanagement.com&c=E,1,7ZfSQ9vAYe7rvB9NwKAqcoBV6_2nCPL09QKb7jG3WYDaiZix9u1hiaulren8GlCVh8tr3ArY61yo0-gZFvLQqJ6pANsbQuIKnEW2EuUntXIIWBvyOuRTAdpQ&typo=1	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://email.double.serviceautopilot.com/c/eJwczE2OrCAQAODTyA5ThfwUCxZv0_coqOJJom1HbZO5_SRzga8d-4ffP0MKRcKWQG0OMVjforMsga04XpR789LQSOkxO4pGC6YFiSjHbHTnsQ0pXnvtot1yXZL1Gthyr2SJckV2vXkQs5bMsUNk5LqACCFoapQqh4SYAzgzigPnEZEAMEKeQw-1xc5OKcWwwORBjm_ddL70fEZT_t7HZ2zHPbdjN1tZ7_szLf8m95rcq4nKOR69Zr0m96rje487ZnOWnd_8X8_Jwzq27RqiO7-Pc1__mKe43wAAAP__Gf5XhQ	Get hash	malicious	Unknown	Browse	104.16.124.96
	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.66.38

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	SeleniumVBA.xlsm	Get hash	malicious	Unknown	Browse	104.21.66.38
	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.66.38
	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	injector V2.4.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	RFQ_PO_N39859JFK_ORDER_SPECIFICATIONS_OM.bat	Get hash	malicious	AgentTesla, DBatLoader	Browse	104.21.66.38
	u.xls	Get hash	malicious	Braodo	Browse	104.21.66.38
	injector V2.4.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	injector V2.5.exe	Get hash	malicious	LummaC	Browse	104.21.66.38

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9510044991696605
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'858'048 bytes
MD5:	6380b8ca2f9bfc1d86617a3a7fd924f1
SHA1:	04ff7e660a59bd2c45098e99a3fd5bff614d2d57
SHA256:	f7b7694decac18c856b37c68c8486eccd09470ec28c7f92d90f5f0905110eb7c
SHA512:	8b7d7728ac97e310b2b01ed34967a8eddb0663427d9d0be4ecdb6b1568194aa2edb1232daeced175d71e2dd7c6c453204b4f004ba8706ee4790473d86f9ab033
SSDEEP:	24576:Un1N/9/M73pKzpmVWfGQiljS+II1JOEQydhrBieETdpZwr4H4DfWtp+QpO68ihGo:U0K9mVWfG1ldB15DxkVhtp+BChOo
TLSH:	468533510F96F37CE1F760F89DED0D62B6727708F9098C3C2D24EA38D5169A70A25176
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g..............................I...........@.......................... J.....5.....@.................................\...p..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x89f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x673F3C51 [Thu Nov 21 13:57:37 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB4CCE521BAh
pabsb mm0, qword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FB4CCE541B5h
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5805c	0x70	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x57000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x581f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x56000	0x26200	2cb0094ee1f447aa2d164d8e76f301d3	False	0.9994748975409836	data	7.987246249896705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x57000	0x2b0	0x200	70f1a79bc3860113a0c2b5e611e88296	False	0.80078125	data	6.026796984354681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x58000	0x1000	0x200	c92ced077364b300efd06b14c70a61dc	False	0.15625	data	1.1194718105633323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x59000	0x2a9000	0x200	140ef775e31cb728401f820822e38b85	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nbqdyuoa	0x302000	0x19c000	0x19ba00	76458bfc600abd08d8ff9974f9334d34	False	0.9944721758275129	data	7.954937787050603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lsjapkzb	0x49e000	0x1000	0x600	eb60b14fc4651334b4bd715c9a0b9fb4	False	0.5904947916666666	data	5.024203837640284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x49f000	0x3000	0x2200	efffe62ed3a7ccf77c2baf133841116d	False	0.06629136029411764	DOS executable (COM)	0.8085361294890754	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x49d5e8	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-21T19:56:59.191822+0100	2057730	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs)	1	192.168.2.4	54395	1.1.1.1	53	UDP
2024-11-21T19:57:01.063780+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	49730	104.21.66.38	443	TCP
2024-11-21T19:57:01.063780+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	104.21.66.38	443	TCP
2024-11-21T19:57:01.802442+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	104.21.66.38	443	TCP
2024-11-21T19:57:01.802442+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	104.21.66.38	443	TCP
2024-11-21T19:57:03.173261+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	49731	104.21.66.38	443	TCP
2024-11-21T19:57:03.173261+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.66.38	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 19:56:59.781342983 CET	49730	443	192.168.2.4	104.21.66.38
Nov 21, 2024 19:56:59.781393051 CET	443	49730	104.21.66.38	192.168.2.4
Nov 21, 2024 19:56:59.781474113 CET	49730	443	192.168.2.4	104.21.66.38
Nov 21, 2024 19:56:59.784647942 CET	49730	443	192.168.2.4	104.21.66.38
Nov 21, 2024 19:56:59.784665108 CET	443	49730	104.21.66.38	192.168.2.4
Nov 21, 2024 19:57:01.063669920 CET	443	49730	104.21.66.38	192.168.2.4
Nov 21, 2024 19:57:01.063780069 CET	49730	443	192.168.2.4	104.21.66.38
Nov 21, 2024 19:57:01.067483902 CET	49730	443	192.168.2.4	104.21.66.38
Nov 21, 2024 19:57:01.067497015 CET	443	49730	104.21.66.38	192.168.2.4
Nov 21, 2024 19:57:01.067892075 CET	443	49730	104.21.66.38	192.168.2.4
Nov 21, 2024 19:57:01.118263006 CET	49730	443	192.168.2.4	104.21.66.38
Nov 21, 2024 19:57:01.126914978 CET	49730	443	192.168.2.4	104.21.66.38
Nov 21, 2024 19:57:01.126956940 CET	49730	443	192.168.2.4	104.21.66.38
Nov 21, 2024 19:57:01.127177954 CET	443	49730	104.21.66.38	192.168.2.4
Nov 21, 2024 19:57:01.802469969 CET	443	49730	104.21.66.38	192.168.2.4
Nov 21, 2024 19:57:01.802596092 CET	443	49730	104.21.66.38	192.168.2.4
Nov 21, 2024 19:57:01.802659988 CET	49730	443	192.168.2.4	104.21.66.38
Nov 21, 2024 19:57:01.806107044 CET	49730	443	192.168.2.4	104.21.66.38
Nov 21, 2024 19:57:01.806126118 CET	443	49730	104.21.66.38	192.168.2.4
Nov 21, 2024 19:57:01.806147099 CET	49730	443	192.168.2.4	104.21.66.38
Nov 21, 2024 19:57:01.806152105 CET	443	49730	104.21.66.38	192.168.2.4
Nov 21, 2024 19:57:01.868021011 CET	49731	443	192.168.2.4	104.21.66.38
Nov 21, 2024 19:57:01.868118048 CET	443	49731	104.21.66.38	192.168.2.4
Nov 21, 2024 19:57:01.868199110 CET	49731	443	192.168.2.4	104.21.66.38
Nov 21, 2024 19:57:01.868766069 CET	49731	443	192.168.2.4	104.21.66.38
Nov 21, 2024 19:57:01.868798971 CET	443	49731	104.21.66.38	192.168.2.4
Nov 21, 2024 19:57:03.173260927 CET	49731	443	192.168.2.4	104.21.66.38

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 19:56:59.191822052 CET	54395	53	192.168.2.4	1.1.1.1
Nov 21, 2024 19:56:59.775448084 CET	53	54395	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 19:56:59.191822052 CET	192.168.2.4	1.1.1.1	0x6120	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 19:56:59.775448084 CET	1.1.1.1	192.168.2.4	0x6120	No error (0)	cook-rain.sbs		104.21.66.38	A (IP address)	IN (0x0001)	false
Nov 21, 2024 19:56:59.775448084 CET	1.1.1.1	192.168.2.4	0x6120	No error (0)	cook-rain.sbs		172.67.155.248	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cook-rain.sbs

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.66.38	443	6408	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 18:57:01 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-21 18:57:01 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-21 18:57:01 UTC	999	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 18:57:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6212j4miqd8j8e1m5h89sm4s8h; expires=Mon, 17-Mar-2025 12:43:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z42g0xRxOVb0lrLHCs7qwAO7KgW73TXIlZTtJPo6qVedj6MQOAntpC4po%2FpRszhrGnfwjeNiYSePXuVPvkTUwejMmz6P4IbEQcwGNXnsjhKFhthDyz5FiULpmzU6viZU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e62e72f7f8b4240-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1731&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=904&delivery_rate=1668571&cwnd=242&unsent_bytes=0&cid=be0829dcb286f22e&ts=763&x=0"
2024-11-21 18:57:01 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-21 18:57:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	13:56:57
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x950000
File size:	1'858'048 bytes
MD5 hash:	6380B8CA2F9BFC1D86617A3A7FD924F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	66.4%
Total number of Nodes:	235
Total number of Limit Nodes:	14

Executed Functions

Function 00989030 Relevance: 21.6, APIs: 5, Strings: 7, Instructions: 629
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(13C511C2), ref: 009891B6
CoSetProxyBlanket.COMBASE(0000FDFC,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 009891FD

Strings

C, xrefs: 009890E6
IK, xrefs: 009893A2
E!q#, xrefs: 00989230, 00989199, 009891B1, 00989688
E!q#, xrefs: 009890D3, 009890DD, 009896A7
Lgfe, xrefs: 00989212
\, xrefs: 009890F1
=3, xrefs: 0098915D

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID: AllocBlanketProxyString
String ID: =3$C$E!q#$E!q#$Lgfe$\$IK
API String ID: 900851650-4011188741
Opcode ID: a6b98b1d6c8312d99b35506abcad0b717ba1e4b2854cf9503a1730447a7874c8
Instruction ID: b7225ecd7e9b8aecc7751ce978986d6c2b91c20084d0e94a85bca4df61257dec
Opcode Fuzzy Hash: a6b98b1d6c8312d99b35506abcad0b717ba1e4b2854cf9503a1730447a7874c8
Instruction Fuzzy Hash: 35224371A083019BE720DF24C881B6BBBAAEFD5354F188A1CF4959B3D1E774D905CB92

Function 0095CF05 Relevance: 18.1, Strings: 14, Instructions: 574
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,_"Q, xrefs: 0095D5C6
<KuM, xrefs: 0095D58F
cook-rain.sbs, xrefs: 0095D341, 0095D771
S7HI, xrefs: 0095D584
0C%E, xrefs: 0095D5A5
7W"i, xrefs: 0095D5DC
;[*], xrefs: 0095D5BB
(), xrefs: 0095D716
c]e, xrefs: 0095D5FD
N3F5, xrefs: 0095D579
y?O1, xrefs: 0095D32D, 0095D33F
BB9321930CE9E017D7CBBD6DF28D3732, xrefs: 0095CF70, 0095D3C0
+S7U, xrefs: 0095D5D1
gy, xrefs: 0095D608

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: ()$+S7U$,_"Q$0C%E$7W"i$;[*]$<KuM$BB9321930CE9E017D7CBBD6DF28D3732$N3F5$S7HI$cook-rain.sbs$y?O1$c]e$gy
API String ID: 0-1599543296
Opcode ID: 718a20c28cfcb5a3d20f2348899575fa332d72d313ea24fd5cbe85065cabbc17
Instruction ID: c5054a9911fb2e97f886042b8fea6ca52843a01d33bbe3cdc54d1fa7286310e4
Opcode Fuzzy Hash: 718a20c28cfcb5a3d20f2348899575fa332d72d313ea24fd5cbe85065cabbc17
Instruction Fuzzy Hash: 02120CB154D3C18ED335CF2AC495BEFBBA1ABD2304F18895CC8DA5B256C774094ACB92

Function 009589A0 Relevance: 1.8, APIs: 1, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 00958CB6

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 38a6888df78534d59b20b62120d7dbe5dac6a74758a5ffec945458337a74d00d
Instruction ID: f1a887cbecdf653e51e5089ef146e8e5bd508895d1f1ae36e695739223c04e83
Opcode Fuzzy Hash: 38a6888df78534d59b20b62120d7dbe5dac6a74758a5ffec945458337a74d00d
Instruction Fuzzy Hash: F571F473B547044BC708DEAAD89235BF6D6ABC8714F09D83D6888D7391EEB89C054785

Function 0098DF70 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0098BA46,?,00000010,00000005,00000000,?,00000000,?,?,00969158,?,?,009619B4), ref: 0098DF9E

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0098B7E0 Relevance: 1.5, APIs: 1, Instructions: 49
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 0098B84E

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 78c5974dfdac06fd98d05769deca1ffe2324ccd30f39db8dda8e8bdb8c770492
Instruction ID: 8b26079160f7d8c7e70530c306d9377b2475fb941596ce430de1b290688f832b
Opcode Fuzzy Hash: 78c5974dfdac06fd98d05769deca1ffe2324ccd30f39db8dda8e8bdb8c770492
Instruction Fuzzy Hash: EB017633A557180BC300AE7CDC9464ABB96EFD9224F2A063CE5D4873D0DA31990A8395

Function 0095CE80 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0095CE94

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: e1fd14ba3f855024b93cd312674fb3384530ce5b407439b276912d964c9fcaf5
Instruction ID: 07e0a9082e63cdf116e5b461bb395fefaa17de192b635d7c2194d2f8deb99640
Opcode Fuzzy Hash: e1fd14ba3f855024b93cd312674fb3384530ce5b407439b276912d964c9fcaf5
Instruction Fuzzy Hash: 88D0A7213A424877D114A61EEC97F27325DC702754F440627A7A2CA2C2D951A915D065

Function 0095CEB3 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0095CEC6

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 8930e31ca16d65562646b6b675296f6453ccd25cd524d0aa6b4a6e0cf2cf043e
Instruction ID: 480a1cb79fc3bd20058c2e455a60405c9c1519a4813c33a0373a245283b60032
Opcode Fuzzy Hash: 8930e31ca16d65562646b6b675296f6453ccd25cd524d0aa6b4a6e0cf2cf043e
Instruction Fuzzy Hash: 8BD012313EC34176F974860C9C53F1022058705F64F340B09B332FE2E1C9D17141950C

Function 0095D7D3 Relevance: 1.3, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 0095D7D3

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: f656ff43ad9f62686d0056aeec7b0883f6496a8d89a004a209a4ad7ce7233cf8
Instruction ID: f8c8045966430e37086e292212e110a97522949cbefeadd2c6987a867e9ef7ed
Opcode Fuzzy Hash: f656ff43ad9f62686d0056aeec7b0883f6496a8d89a004a209a4ad7ce7233cf8
Instruction Fuzzy Hash: 4BA0113BB00008888B8000A8B8020EEF320E28003AB0002B3C328C2800EA22A2288280

Non-executed Functions

Function 00973D70 Relevance: 24.3, Strings: 19, Instructions: 515COMMON

Download Yara Rule

Strings

, xrefs: 00974182
:, xrefs: 00973F97
;, xrefs: 00973F92
n, xrefs: 00973F8D
`, xrefs: 00974212
e, xrefs: 00974203
f, xrefs: 00974458
g, xrefs: 0097420D
g, xrefs: 00973E14
`, xrefs: 00973E1C
e, xrefs: 00974450
,, xrefs: 009742B7
e, xrefs: 00973E04
f, xrefs: 00974208
g, xrefs: 00974460
`, xrefs: 00974468
f, xrefs: 00973E0C
!@, xrefs: 00973DA3
9, xrefs: 00973F9C

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID: AllocateHeap
String ID: $!@$,$9$:$;$`$`$`$e$e$e$f$f$f$g$g$g$n
API String ID: 1279760036-1524723224
Opcode ID: dd3e452c7c0462840ef3572d84fe2ae9cf5da84567aba0a32afb08132e022b9c
Instruction ID: ffb350a4030466505b4afe674c0e5d2b4a9e01001597b11c90177291a4c9ac89
Opcode Fuzzy Hash: dd3e452c7c0462840ef3572d84fe2ae9cf5da84567aba0a32afb08132e022b9c
Instruction Fuzzy Hash: 67228CB260C3808FD3219F28C4943AFBBE1AB95314F188D6DE5D987392D77A8845DB53

Function 009594D0 Relevance: 17.9, Strings: 14, Instructions: 385COMMON

Download Yara Rule

Strings

_CYG, xrefs: 00959638
txfF, xrefs: 00959610
u{{h, xrefs: 009595F0
ZS, xrefs: 00959533
8, xrefs: 00959838
BDZF, xrefs: 00959628
SD]z, xrefs: 00959640
=86o, xrefs: 00959688
N, xrefs: 009596A1
f)2s, xrefs: 00959600
p8Bb, xrefs: 009595E8
RHL9, xrefs: 0095958E
n[, xrefs: 00959630
mmi., xrefs: 00959608

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: n[$8$=86o$BDZF$N$RHL9$SD]z$ZS$_CYG$f)2s$mmi.$p8Bb$txfF$u{{h
API String ID: 0-1787199350
Opcode ID: 4f528f0c90cc623b71a293a4037b626f3364ba5f16f27244a2274f38ff2d6f74
Instruction ID: 3821235d6111a435fb98f2f1d9cff63994e6d8c976be76ce741446db9d67398b
Opcode Fuzzy Hash: 4f528f0c90cc623b71a293a4037b626f3364ba5f16f27244a2274f38ff2d6f74
Instruction Fuzzy Hash: 24B1E87010C3818FD315CF2A80607ABBFE5AF97345F18496DE8D58B392D779890ACB52

Function 009598F0 Relevance: 11.7, Strings: 9, Instructions: 428COMMON

Download Yara Rule

Strings

chs,, xrefs: 00959B51
Ohs,, xrefs: 00959B2A
DG, xrefs: 00959D35
{}, xrefs: 00959CBD
fhnf, xrefs: 00959C10
fhnf, xrefs: 00959BE4, 009599B7, 009599E0
BB9321930CE9E017D7CBBD6DF28D3732, xrefs: 009599C1
su, xrefs: 00959CCD
xy, xrefs: 00959E03

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: BB9321930CE9E017D7CBBD6DF28D3732$DG$Ohs,$chs,$fhnf$fhnf$xy$su${}
API String ID: 0-2990117919
Opcode ID: 88726869b184a321e45550151c67a99f07daf8cccf6dd3472475b1ea15f4e0ff
Instruction ID: 79d301fd1407cc2c148e8868f140c167d054a07573848faa290c601e22158ca1
Opcode Fuzzy Hash: 88726869b184a321e45550151c67a99f07daf8cccf6dd3472475b1ea15f4e0ff
Instruction Fuzzy Hash: 05E15D72A483508BD324CF36C85136BBBE6EBD1314F198A2DE9E58B395D734C809CB42

Function 00B15C78 Relevance: 10.3, Strings: 7, Instructions: 1589COMMON

Download Yara Rule

Strings

e&~, xrefs: 00B15F3E
.`{, xrefs: 00B15DCE
bw>, xrefs: 00B15CB8
#[, xrefs: 00B1641D
#[, xrefs: 00B16418
=0}w, xrefs: 00B165E6
dC?g, xrefs: 00B16A34

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: .`{$=0}w$dC?g$e&~$#[$#[$bw>
API String ID: 0-6439773
Opcode ID: cd2eaf400f6b9e4e80e446027cb6ce177d5ab8444c9eb6c6b0513d412e99934a
Instruction ID: 31181eb35cd1d582626ba5c12c80c5128797f4669e9edf9132ac6199826b8260
Opcode Fuzzy Hash: cd2eaf400f6b9e4e80e446027cb6ce177d5ab8444c9eb6c6b0513d412e99934a
Instruction Fuzzy Hash: 41B2F3F3A0C2009FE304AE29DC8567AFBE5EF94720F16893DE6C4C7744EA3598458796

Function 00B22338 Relevance: 9.6, Strings: 7, Instructions: 805COMMON

Download Yara Rule

Strings

xAO, xrefs: 00B22923
U, xrefs: 00B22A07
2zm", xrefs: 00B226F2
L'w, xrefs: 00B2283D
SnT, xrefs: 00B22B41
i|, xrefs: 00B22BFA
L'w, xrefs: 00B22837

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: U$2zm"$L'w$L'w$SnT$i|$xAO
API String ID: 0-2499630841
Opcode ID: f6afefd746103d69dcfd7d55f6465d9c1e29148f5352e4fecba13a550ae3707b
Instruction ID: 719f6585735a7f5852b2a65cd6e8a68cc228bb952b1c5fd40d94da9615e5ec1c
Opcode Fuzzy Hash: f6afefd746103d69dcfd7d55f6465d9c1e29148f5352e4fecba13a550ae3707b
Instruction Fuzzy Hash: E64207B360C314AFE3046E2DEC8567AF7E5EF94720F1A4A3DE6C483744EA3558418697

Function 0096DB30 Relevance: 9.0, Strings: 7, Instructions: 235COMMON

Download Yara Rule

Strings

CN, xrefs: 0096DBEA
}~, xrefs: 0096DBFA
SRQ, xrefs: 0096DB4F
5[Y, xrefs: 0096DCD6
_], xrefs: 0096DB47
Lw, xrefs: 0096DBF2
8, xrefs: 0096DD13

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: 5[Y$8$CN$Lw$}~$SRQ$_]
API String ID: 0-3274379026
Opcode ID: 8b48ac208c5107d484f978683f7eabed457e4a906544c2b868d1399e3fd378ac
Instruction ID: e18594b3c9ada7e3b132917f6342c0277797463e3c410f245be945ab1dd2cacd
Opcode Fuzzy Hash: 8b48ac208c5107d484f978683f7eabed457e4a906544c2b868d1399e3fd378ac
Instruction Fuzzy Hash: 65515971A193518BD320CF25C8902ABB7F6FFD2341F18895CE8D18B295EB788906C792

Function 00B1C836 Relevance: 7.9, Strings: 5, Instructions: 1621COMMON

Download Yara Rule

Strings

$jy, xrefs: 00B1D207
S~W, xrefs: 00B1CA9C
_zJn, xrefs: 00B1D4F5
\co, xrefs: 00B1DA47
O9bM, xrefs: 00B1D6B3

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: $jy$O9bM$\co$_zJn$S~W
API String ID: 0-3200088448
Opcode ID: d169d53575233063eb6868d4d3f2d5e4c70d98fbe5d0fe053789b2ff54782f5a
Instruction ID: d881bfc1720706f0213732b49438885f72f511d539ba4a163b6b9900feb89065
Opcode Fuzzy Hash: d169d53575233063eb6868d4d3f2d5e4c70d98fbe5d0fe053789b2ff54782f5a
Instruction Fuzzy Hash: A9B2F7F36082049FE304AE2DEC8577ABBE9EFD4720F1A893DE6C4C7744E63558058696

Function 00B141FF Relevance: 6.6, Strings: 4, Instructions: 1650COMMON

Download Yara Rule

Strings

6'N, xrefs: 00B1474F
tu, xrefs: 00B14248
v^#^, xrefs: 00B14B4A
;~, xrefs: 00B15132

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: 6'N$v^#^$;~$tu
API String ID: 0-2988868443
Opcode ID: 2e9d351e18cde9d5527a9a27837e85131efbf9511378b21fffb51567cad47e2e
Instruction ID: 094f85d15c392bb3ba9a03599f0f4aec1ef3e89365a516c9a216c45819a03fbe
Opcode Fuzzy Hash: 2e9d351e18cde9d5527a9a27837e85131efbf9511378b21fffb51567cad47e2e
Instruction Fuzzy Hash: EEB2F8F360C204AFE304AE2DEC8567BB7E9EF94720F1A853DE6C583744E63558058696

Function 0095E35B Relevance: 6.5, Strings: 5, Instructions: 295COMMON

Download Yara Rule

Strings

cook-rain.sbs, xrefs: 0095E752
Zb, xrefs: 0095E59F
Lk, xrefs: 0095E749, 0095E750
r, xrefs: 0095E385
U\, xrefs: 0095E5AA

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: Lk$U\$Zb$cook-rain.sbs$r
API String ID: 0-1143509894
Opcode ID: 50bbe559b3c1c8e1ba26577e69a880eb6760ebb236f9eb2ec2b1fd4bd5d1fbad
Instruction ID: b0b72744329529d0bb5c6b7117f264a5ca635cf9515b685b538946f8819d76c0
Opcode Fuzzy Hash: 50bbe559b3c1c8e1ba26577e69a880eb6760ebb236f9eb2ec2b1fd4bd5d1fbad
Instruction Fuzzy Hash: 3CA1BE7010C3D18AD779CF26D4947EFBBE1AB93308F18895DD4E94B292E739460A8B47

Function 00959210 Relevance: 6.5, Strings: 5, Instructions: 269COMMON

Download Yara Rule

Strings

84*6, xrefs: 009592FC
7514, xrefs: 009592DC
)=+4, xrefs: 009592E4
57, xrefs: 00959229
N, xrefs: 00959230

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: )=+4$57$7514$84*6$N
API String ID: 0-4020838272
Opcode ID: be85e90a30f89c364b58cec467ad0dcda84538ec37489d1a8be0575a1ed0ed84
Instruction ID: 8bf1750eaf05d6e2b07684a23e607976ed1170e982539d622e664e0322536b27
Opcode Fuzzy Hash: be85e90a30f89c364b58cec467ad0dcda84538ec37489d1a8be0575a1ed0ed84
Instruction Fuzzy Hash: EB71A16110C3D28BE315CF2A84A037BFFE59FA2305F18499DE4D64B292D779890AC752

Function 00970870 Relevance: 5.9, Strings: 4, Instructions: 861COMMON

Download Yara Rule

Strings

GZE^, xrefs: 00970C7C
=79, xrefs: 00970C2E
BBSH, xrefs: 00970C90
+2/?, xrefs: 00970C19

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: +2/?$=79$BBSH$GZE^
API String ID: 0-3392023846
Opcode ID: be42e8a764808261ecc8ad8a87e2e0861b5e0d724bef01d0a4a837402fa0af2e
Instruction ID: eedc81f971a00c2e53aadd4cdced74de006454a2cd6b9e9529a1ef2a54075bb8
Opcode Fuzzy Hash: be42e8a764808261ecc8ad8a87e2e0861b5e0d724bef01d0a4a837402fa0af2e
Instruction Fuzzy Hash: 5552F172504B418FC735CF39C890766BBE1BF96314F188A6DD4EA8BB92D735A806CB50

Function 0095B210 Relevance: 5.5, Strings: 4, Instructions: 464COMMON

Download Yara Rule

Strings

=>?, xrefs: 0095B69F
H{D}, xrefs: 0095B4A0
TgXy, xrefs: 0095B496
_o]a, xrefs: 0095B482

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: H{D}$TgXy$_o]a$=>?
API String ID: 0-2004217480
Opcode ID: a1d68ad26a7fec1c2052a529a026d288029e70e4522163ee1be9b6643a1f7cd8
Instruction ID: 470d695257d499e8f1df6e583b9df51ce6b7dcd6e9b69bc2b86ae0a65be947ad
Opcode Fuzzy Hash: a1d68ad26a7fec1c2052a529a026d288029e70e4522163ee1be9b6643a1f7cd8
Instruction Fuzzy Hash: 781278B1114B01CFD324CF2AD891B97BBF5FB45315F058A2DE5AA8BAA0DB74A405DF80

Function 00977E20 Relevance: 5.5, Strings: 4, Instructions: 461COMMON

Download Yara Rule

Strings

a{, xrefs: 00977F51
=:;8, xrefs: 009783E6
=:;8, xrefs: 00978194
kp, xrefs: 00977F67

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: =:;8$=:;8$a{$kp
API String ID: 0-2717198472
Opcode ID: 2c3e7868dbb423809a5d67cbf3df7c4785ac56a66982f9336f6331b7e984a746
Instruction ID: fcf076c4fd46b3dc8cc882c62c2f7e5dca16bd598f189ae941355add9c3df4df
Opcode Fuzzy Hash: 2c3e7868dbb423809a5d67cbf3df7c4785ac56a66982f9336f6331b7e984a746
Instruction Fuzzy Hash: 50E1DCB656C341CFE720CF68D88576BBBE5FBC5304F04892DE5898B2A1EB749805CB42

Function 0095AD00 Relevance: 5.4, Strings: 4, Instructions: 424COMMON

Download Yara Rule

Strings

@A, xrefs: 0095AEE0
svfZ, xrefs: 0095AD62
lPLN, xrefs: 0095AD12
IK, xrefs: 0095ADA1

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: @A$lPLN$svfZ$IK
API String ID: 0-1806543684
Opcode ID: 5137025f8d5bbdf8f63d9fe5898284a73eebf21aa647196d706f6c7040b1bb8b
Instruction ID: e339959874e05afd473bbcaa4a2db4e350e2a5e9fea9e6d4ed20d0f697c47323
Opcode Fuzzy Hash: 5137025f8d5bbdf8f63d9fe5898284a73eebf21aa647196d706f6c7040b1bb8b
Instruction Fuzzy Hash: F7C1287164C3848FD324CE6594A136FBBE6EBC2711F18C92CE8E54B385D7798C099B82

Function 00B1E2E7 Relevance: 5.4, Strings: 3, Instructions: 1612COMMON

Download Yara Rule

Strings

rU, xrefs: 00B1F167
+0+8, xrefs: 00B1EFE0
cSz;, xrefs: 00B1E845

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: +0+8$cSz;$rU
API String ID: 0-3708242785
Opcode ID: 35f6a391a4bec5a5fa58047a66a21f5ae046a6d76167a6cc3455145eabfdd930
Instruction ID: af40f0e9044ebd03d864e95a898792c3e48a5f5568ba137a58f6527601aee48c
Opcode Fuzzy Hash: 35f6a391a4bec5a5fa58047a66a21f5ae046a6d76167a6cc3455145eabfdd930
Instruction Fuzzy Hash: 1BB226F3A0C2049FE3146E2DEC8567ABBE9EF94320F16493DEAC4D3744E63598058697

Function 00B192F9 Relevance: 4.1, Strings: 2, Instructions: 1607COMMON

Download Yara Rule

Strings

V`~e, xrefs: 00B1A093
^o|~, xrefs: 00B19CEA

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: V`~e$^o|~
API String ID: 0-3152785151
Opcode ID: fcdec7f32b011804db4124e1c9638c5a45e2062e9b57c9087d948026f61f2b75
Instruction ID: ac821825588c4ca5b6a34d64ade2f0e37caa7ad0bfdff9fcee4bc50be6d4d512
Opcode Fuzzy Hash: fcdec7f32b011804db4124e1c9638c5a45e2062e9b57c9087d948026f61f2b75
Instruction Fuzzy Hash: F8B205F3A0C204AFE3046E29EC8567AFBE5EF94320F1A493DEAC4D7744E63558418697

Function 00975E90 Relevance: 4.0, Strings: 3, Instructions: 295COMMON

Download Yara Rule

Strings

VD, xrefs: 00975EE3
KP, xrefs: 00975EEA
@J, xrefs: 00975EF1

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: @J$KP$VD
API String ID: 0-3841663987
Opcode ID: 7c2dcd37e06a5203d68b7eaf91e6ca0f019bc3f451755d205312b366bd61b844
Instruction ID: 5d154f7d7917c5d5bf955de7d1b12c800e172c283d10dce082cf8a00f677eff9
Opcode Fuzzy Hash: 7c2dcd37e06a5203d68b7eaf91e6ca0f019bc3f451755d205312b366bd61b844
Instruction Fuzzy Hash: CF917672704B05AFE720CF68CC817ABBBB1FB81310F14852DE5999B781C374A815DB92

Function 0095C02B Relevance: 3.9, Strings: 3, Instructions: 166COMMON

Download Yara Rule

Strings

A_, xrefs: 0095C181
PQ, xrefs: 0095C1A1
IG, xrefs: 0095C171

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: PQ$A_$IG
API String ID: 0-2179527320
Opcode ID: 76a8e764a151a31c8b6139d9fd64fa06283f218d318f9140c0e354361e21488d
Instruction ID: d8411447daab09e79e71b8a8276a54aebd7721ddde45e1673b8c65b9bec1051e
Opcode Fuzzy Hash: 76a8e764a151a31c8b6139d9fd64fa06283f218d318f9140c0e354361e21488d
Instruction Fuzzy Hash: E741BAB000C341CEC704CF26D88266BB7F5FF96759F249A0DE4C59B291E338864ACB4A

Function 0098F8D0 Relevance: 3.3, Strings: 2, Instructions: 813COMMON

Download Yara Rule

Strings

jC, xrefs: 0098FAB7
cC, xrefs: 0098FA5E

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: cC$jC
API String ID: 0-2055910567
Opcode ID: 3e4005db233bf1335699e4e9814fbd9ece8343bcf5e757358b18f93742d9f948
Instruction ID: 9a9c88ec23d242b5a5f2292d05ec80e9497c1ec05efe37efd97546e0bde79897
Opcode Fuzzy Hash: 3e4005db233bf1335699e4e9814fbd9ece8343bcf5e757358b18f93742d9f948
Instruction Fuzzy Hash: 1342E336F18215CFCB18CF69D8A16AEB7F2FB89310F19857EC956A7391D6349901CB80

Function 0098C040 Relevance: 3.1, Strings: 2, Instructions: 624COMMON

Download Yara Rule

Strings

, xrefs: 0098C167, 0098C17A
f, xrefs: 0098C271

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: f$
API String ID: 2994545307-508322865
Opcode ID: c2c4e212a2573024a09b7b8ed0e6be832723e0fae669f06581b23c1d32130b08
Instruction ID: 33397d37406da517859e1099f034876ddf3a166b8a07783abba1d062769f39fa
Opcode Fuzzy Hash: c2c4e212a2573024a09b7b8ed0e6be832723e0fae669f06581b23c1d32130b08
Instruction Fuzzy Hash: 5E12D1B060C3419FD714DF29D8D0A2BBBE5EBC5324F248A2DE595873A2D731D846CB62

Function 009824E0 Relevance: 2.8, Strings: 2, Instructions: 254COMMON

Download Yara Rule

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 00982591
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 009825D2

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
API String ID: 0-2492670020
Opcode ID: 2d529d68b8cd04c267fa7692fcacacb19812bd326424e4561c7c690b7fbc08dc
Instruction ID: e67eafc48c7943c83199cfe70ba395d0529b2c5aff7bdd9d1613448c4eb329a4
Opcode Fuzzy Hash: 2d529d68b8cd04c267fa7692fcacacb19812bd326424e4561c7c690b7fbc08dc
Instruction Fuzzy Hash: DE816C33A586914BCB189F3C8C513A97BA65F97330F3DC3AAE8729B3D5D1298D059350

Function 00955AC9 Relevance: 2.7, Strings: 2, Instructions: 219COMMON

Download Yara Rule

Strings

8, xrefs: 009555BC
0, xrefs: 009555C4

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 0e147c000869c5118910bbd82a142c9703e7aa5d2e987ccdc7f020e7616856d5
Instruction ID: 99103e2f97f43fae14d07c4a39ef79813122b81845158234d95cb6a705a76c4c
Opcode Fuzzy Hash: 0e147c000869c5118910bbd82a142c9703e7aa5d2e987ccdc7f020e7616856d5
Instruction Fuzzy Hash: F9A11035609780DFD320CF28D840B9EBBE1AB89304F15895DE9C897362C775E958DF52

Function 0095542C Relevance: 2.7, Strings: 2, Instructions: 217COMMON

Download Yara Rule

Strings

8, xrefs: 009555BC
0, xrefs: 009555C4

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 74964a348831c8d57e509ce2f8ab152ac185bed5b03228d386afd91b22add0a4
Instruction ID: 1b032f19663e2e35b1f4d195f30df47241eab204ee21d79ae50ea50497831ca7
Opcode Fuzzy Hash: 74964a348831c8d57e509ce2f8ab152ac185bed5b03228d386afd91b22add0a4
Instruction Fuzzy Hash: A5A12F3560C780DFD321CF28D84079ABBE1AB89304F1A895DE9C897362C774E958DF92

Function 00A03A35 Relevance: 2.7, Strings: 2, Instructions: 203COMMON

Download Yara Rule

Strings

]5<K, xrefs: 00A03AFD
9|W, xrefs: 00A03C6B

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: 9|W$]5<K
API String ID: 0-2740929668
Opcode ID: 9c7338d929fb4dc0a827d9f0617a15c1aeb5c060357b193b53a88440711ac8d5
Instruction ID: bfc202c627d6cb0d09bc6f6d40c23d3b9c3af9f3460c717ff5c105bfcee5479b
Opcode Fuzzy Hash: 9c7338d929fb4dc0a827d9f0617a15c1aeb5c060357b193b53a88440711ac8d5
Instruction Fuzzy Hash: 75514BF39083049BE7047E3DED8477ABBD9EB94360F17463EE6C983784E57A58048682

Function 009F0E1A Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

FoO, xrefs: 009F0FB9
A%7, xrefs: 009F0F77

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: A%7$FoO
API String ID: 0-3590906921
Opcode ID: 813c2607d45b3e4b90bfbec41fdaf9b659cc1629e8a3b0366008e3a5a416ce64
Instruction ID: 641a8457500ba06a5a0f826325889ea421380d68b281aafcf2a9a2b71745d66f
Opcode Fuzzy Hash: 813c2607d45b3e4b90bfbec41fdaf9b659cc1629e8a3b0366008e3a5a416ce64
Instruction Fuzzy Hash: EF4115B3A082148BE300AE2DDC9477ABBEAEBC4710F16853DEAC897745E9355C058786

Function 0095E970 Relevance: 2.6, Strings: 2, Instructions: 106COMMON

Download Yara Rule

Strings

efg`, xrefs: 0095E8E0
efg`, xrefs: 0095E990

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: efg`$efg`
API String ID: 0-3010568471
Opcode ID: 99b52bab3d5bca4884a55df1a6a85b2bac7538923d1ada5801132de7b3091caa
Instruction ID: 3488c1a65f9029218c3ae399efe3a96745c9d899228eb9af8d8edd8a15239982
Opcode Fuzzy Hash: 99b52bab3d5bca4884a55df1a6a85b2bac7538923d1ada5801132de7b3091caa
Instruction Fuzzy Hash: CA31E232A183508BC328CF52C5A166FB392BFE4301F5A482DDDC667255CE319E0AC7D2

Function 00978CB0 Relevance: 1.7, Strings: 1, Instructions: 490COMMON

Download Yara Rule

Strings

st@, xrefs: 009791A4, 009791E4, 00979206, 0097920A

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: st@
API String ID: 0-3741395493
Opcode ID: b8b6723f97c020fcee12aa26fe1da8dde312511435b133966649d20cc08dec4e
Instruction ID: 5eff3019d6a60ac714e50db64c1e507f876fadcccbf12087d1cbac2eee1b8b51
Opcode Fuzzy Hash: b8b6723f97c020fcee12aa26fe1da8dde312511435b133966649d20cc08dec4e
Instruction Fuzzy Hash: 65F125B251C3818FD304DF68885136BBBE6AF95304F18886DE5D987382DB79D909CB92

Function 00978770 Relevance: 1.7, Strings: 1, Instructions: 466COMMON

Download Yara Rule

Strings

=:;8, xrefs: 009787FC

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: =:;8
API String ID: 2994545307-508151936
Opcode ID: 0ce44370a775714d7aa3b475fcb7f16cc59bb089a95ae525883f1357a25b996c
Instruction ID: 0b13ee12262c876f6569a2b07844c4dedc42f0e71e182ab27f7433f6a3c08728
Opcode Fuzzy Hash: 0ce44370a775714d7aa3b475fcb7f16cc59bb089a95ae525883f1357a25b996c
Instruction Fuzzy Hash: A8D15C73A983118BD714CA28CC86377B796EBC5314F1DC93DD98A4B391EA749C06C792

Function 00969530 Relevance: 1.7, Strings: 1, Instructions: 449COMMON

Download Yara Rule

Strings

efg`, xrefs: 009698E5

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: efg`
API String ID: 0-115929991
Opcode ID: 353dd49fb77271c6dced7784c5efd7f2c674e4943589bfe80d1992964723fba2
Instruction ID: 50037e331a0b223c8b08031962c6692824292825142558e0f0777e2975bd0e38
Opcode Fuzzy Hash: 353dd49fb77271c6dced7784c5efd7f2c674e4943589bfe80d1992964723fba2
Instruction Fuzzy Hash: 5FC13671D14215CFCB24CF58DC92ABB73B8FF86314F184569E852A72A1E734A901CBA1

Function 00990F60 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00990FBA

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: _^]\
API String ID: 2994545307-3116432788
Opcode ID: a90e9950eb8ec0a279ecf2f14c16affc7f51309681c3c2091812ff16993e8774
Instruction ID: 6240d7a44d74ed097f5b2e5cb62cc955378cb81ccfbb107c90b2707df1462300
Opcode Fuzzy Hash: a90e9950eb8ec0a279ecf2f14c16affc7f51309681c3c2091812ff16993e8774
Instruction Fuzzy Hash: 1B81CE352083429FCB28EF1CD490A2AB7E5FF99710F05896CE9928B365D731EC51CB82

Function 009561A0 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 009562D6

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 8b04fab32ec0b8383da590e4bd15150657e1dcf751765b097a457d664c512576
Instruction ID: 75ddab23a2a904666719939ceb43697c5965758eae4aba361bdb9d122e5372ce
Opcode Fuzzy Hash: 8b04fab32ec0b8383da590e4bd15150657e1dcf751765b097a457d664c512576
Instruction Fuzzy Hash: D8B137712083819FD325CF59C89061BFBE0AFA9704F844E2DF5D997782D631E918CBA6

Function 0098BCE0 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

5|iL, xrefs: 0098BED0

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: 5|iL
API String ID: 2994545307-1880071150
Opcode ID: 26ac3d9820245d020d7b6750740a60eebcee687043529f5e948b158b1ea58688
Instruction ID: 7d6306c036a7916675be22b21b80cdd192e647b9ea1f247da0ec6fc488121c06
Opcode Fuzzy Hash: 26ac3d9820245d020d7b6750740a60eebcee687043529f5e948b158b1ea58688
Instruction Fuzzy Hash: B6710A32A193109FC714AF2DCC80667B7A6EBC5324F1D866DE9959B3A5C371DC028BC1

Function 00A58D26 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

>9y[, xrefs: 00A58EE2

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: >9y[
API String ID: 0-407815250
Opcode ID: e48791e5090c15be74c0e1c7f72e13ab632b46fd699a1cd6583225d9cbfc319b
Instruction ID: 85080a7bdb9a8a84f63410ad13ec56b18017c88be80a390a83932b3b29630441
Opcode Fuzzy Hash: e48791e5090c15be74c0e1c7f72e13ab632b46fd699a1cd6583225d9cbfc319b
Instruction Fuzzy Hash: 106149F3E092045BF3146A29DC4472AB7EADBE4320F1B463DDE8893780F97A1D064596

Function 009DEFA3 Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

Y'EP, xrefs: 009DF041

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: Y'EP
API String ID: 0-1277568485
Opcode ID: f1ed2769f867e75a7c4e71a4e446900c4bbfedd899c4d02dc495c603d64bd003
Instruction ID: c1296fef223c63ca59163e08c3c60dc50fdb9f2efe61fb513de582dccc96b952
Opcode Fuzzy Hash: f1ed2769f867e75a7c4e71a4e446900c4bbfedd899c4d02dc495c603d64bd003
Instruction Fuzzy Hash: 3B6118F3A186049FE3046E28DCD577EBBD5EB98320F1A493DEBC497780D63958058686

Function 0095E0D8 Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

efg`, xrefs: 0095E100

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: efg`
API String ID: 2994545307-115929991
Opcode ID: 8081bbb3337ef52eee12225f370bf1b32451a4669d485a1eb7c1eebf5a2ce31e
Instruction ID: a47258d666b7985cf0fd3727927687be77ce762727df9d3ac300d534f0f0c0e4
Opcode Fuzzy Hash: 8081bbb3337ef52eee12225f370bf1b32451a4669d485a1eb7c1eebf5a2ce31e
Instruction Fuzzy Hash: 1E515A72A087504BD725EF629C827AF73A7AFD1305F194428ED8D67246DF316A0A83D3

Function 009C156C Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

<, xrefs: 009C15B8

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-930352506
Opcode ID: 9ee006b158cb6a19ed6725d10c65d91de5fe012e2c2d084feaefc10b665aab3b
Instruction ID: 6b968659ca16910277573f6c4a2f99b4c6c69a6e84d9f6dd877bd0011080fe81
Opcode Fuzzy Hash: 9ee006b158cb6a19ed6725d10c65d91de5fe012e2c2d084feaefc10b665aab3b
Instruction Fuzzy Hash: 3F5126F3A092049FF344AE29DC4576AF7E6EFD4720F16C53DE6C487748EA3888068656

Function 00A4E3B8 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

Z5ls, xrefs: 00A4E3CB

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: Z5ls
API String ID: 0-2802848652
Opcode ID: db8d5fed9309294e2716293101b327fa84531a12f66da0ef33f107f3e6e3773a
Instruction ID: c938b0c3c471f921b11aef90fbed85ba345e109586d89304e2d3c562566747c0
Opcode Fuzzy Hash: db8d5fed9309294e2716293101b327fa84531a12f66da0ef33f107f3e6e3773a
Instruction Fuzzy Hash: D25117B3A182109FE7146E3CDC8476AF7E4EB44720F16493DEAC9D7780E679594086C6

Function 00ACC52A Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

a]wk, xrefs: 00ACC591

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: a]wk
API String ID: 0-2091165048
Opcode ID: 4c9e5dce24925b536786097b8fe64ced89169ab264af2f56299dd63907041ba0
Instruction ID: 81c305f3a7e811f27c38dd9e55bec5afa5212efb62a1c04a60d7b281e55ab7d3
Opcode Fuzzy Hash: 4c9e5dce24925b536786097b8fe64ced89169ab264af2f56299dd63907041ba0
Instruction Fuzzy Hash: 2C416DF3A182200BE358593DDD597BBB6C6DB84320F1A823DE649DBB84E874880542C5

Function 0095EA38 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

D, xrefs: 0095EC76

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 93720a434fd72a504d5d5ec2be75337a2f9202a6ba91ce866d812b250c14a119
Instruction ID: 9c0be197603b07abf933f2aab8723f7406fe65f6698d73e557085ad35fc97b93
Opcode Fuzzy Hash: 93720a434fd72a504d5d5ec2be75337a2f9202a6ba91ce866d812b250c14a119
Instruction Fuzzy Hash: 585120B05593808BE320CF16C86175BBBF1FB91B45F20980CE6E91B294D7B68909CF83

Function 009577D0 Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e56e85d3793a0f4e761ff8f8362607d8bf849bd197acd1c0af18c6b7dbfe6d
Instruction ID: 35f01e51d543c195de804ecb82bf10a6e70a525e4c26fac5506e2d35e20eb6b0
Opcode Fuzzy Hash: a9e56e85d3793a0f4e761ff8f8362607d8bf849bd197acd1c0af18c6b7dbfe6d
Instruction Fuzzy Hash: 3742E23160C3118BC724DF6AE8806ABF3E2FFC4315F25892DDD9697285D734AA59CB42

Function 00956CC0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbc8d7dc13d15547020f448ea90b53c10b9b31299ed98ac60045d8bbd4989f54
Instruction ID: 5b616334bf24984fb7d45863ee943ffaa8acd7aef3d703595992eb86e2ca480f
Opcode Fuzzy Hash: dbc8d7dc13d15547020f448ea90b53c10b9b31299ed98ac60045d8bbd4989f54
Instruction Fuzzy Hash: C152E57090CB848FEB30CB25D0843A7FBE5AB51315F54482DD9EB06AC2D279AA8DC752

Function 00954AC0 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff809f2f7ad0042e18c2a0fca4d118e7bd043d6aee33c9a02aabfbf878cc2ff
Instruction ID: 92c6bead6f39a0eb8491022f246d15ce9f86a65c7896f0c634a45294e87579b7
Opcode Fuzzy Hash: 6ff809f2f7ad0042e18c2a0fca4d118e7bd043d6aee33c9a02aabfbf878cc2ff
Instruction Fuzzy Hash: 9C426734618301DFD744CF29D89576ABBE1BF88355F05882DE8898B2A1D379D988DF82

Function 00952B80 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff7de26b510617ce11c07771ebf8440ac0aaacb9950658ef9912b67ac661537b
Instruction ID: ad47f1a7b9d8260dde2a4139242808ccca2cfa6dcfe98788785d6b5576e502da
Opcode Fuzzy Hash: ff7de26b510617ce11c07771ebf8440ac0aaacb9950658ef9912b67ac661537b
Instruction Fuzzy Hash: 5652DE315083458BCB15CF2AC0806AABBE1BF89355F188A6DFC995B351D778E94DCF81

Function 00953580 Relevance: .6, Instructions: 631COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beffd9a76fe7860c661bf9b24b59189581af26c1634ff680299d98ee4bad56b6
Instruction ID: a25d2bccefee35c7243f65e2650eee6e376fa2de0b499af4682a6065b66f57dd
Opcode Fuzzy Hash: beffd9a76fe7860c661bf9b24b59189581af26c1634ff680299d98ee4bad56b6
Instruction Fuzzy Hash: 224269B1914B118FC328CF2AC590526BBF1BF85351B648A2EDA9787F90D736F949CB10

Function 00955C90 Relevance: .4, Instructions: 417COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a1d6e3d5ba60b3bd1d97c05962dbaf1adc3ce7802fd18f61ea84a3f4fb9068
Instruction ID: 2b908af1ef787b7bc474a21f57da36a97ba7e93056f056d2187b38abe19b2022
Opcode Fuzzy Hash: 21a1d6e3d5ba60b3bd1d97c05962dbaf1adc3ce7802fd18f61ea84a3f4fb9068
Instruction Fuzzy Hash: B5F18B712087418FC724CF2AC881B6BBBE6FF95300F44492DE8D687792E635E948CB56

Function 00956840 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86e445ca3b438742181d2dbf2e8c100afcf3d334dfe90873b41fa4f189d33e65
Instruction ID: 862f37011438bd3c64b15889ad8fec28b81efed8c48011a0925c33a183c47be4
Opcode Fuzzy Hash: 86e445ca3b438742181d2dbf2e8c100afcf3d334dfe90873b41fa4f189d33e65
Instruction Fuzzy Hash: EDC19CB2A083418FC364CF68C89679BB7E1BF81318F484A2DD5DAC7341E678A549CB45

Function 009887B0 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba1380cb9152e7cdc994e456a920f27018b5a696dcda6c5b24acc876655b729
Instruction ID: 7aaadcaa948c032e412deb486813d535d42d187f653d49dadf28a4671b7723a3
Opcode Fuzzy Hash: 5ba1380cb9152e7cdc994e456a920f27018b5a696dcda6c5b24acc876655b729
Instruction Fuzzy Hash: D4B14B72D086D18FDB11CA7CC88035A7FA26B97220F5DC7D5D5A5AB3C6C6364806C7B2

Function 00991580 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9c6f5acb20c206c82c37232745e7bb22dbb553c5f9d223bb08d499dc21882338
Instruction ID: 79edf0cc893afae945da9a81c797642282949ea722eceb59fe5cdd89f1d166b6
Opcode Fuzzy Hash: 9c6f5acb20c206c82c37232745e7bb22dbb553c5f9d223bb08d499dc21882338
Instruction Fuzzy Hash: 9B81E071A183428FDB14DE6CD890B2BB7E5FF89310F08893DE996D7291E674DC458782

Function 0098C780 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc4211ff3559cfbc8cdfa33303a04b21ffa8fe43044cf814f80c683d3ac2f88
Instruction ID: ae66b54dae91651753070dc84e92e87970af423d668ce5e9cc5da24eeb2950ed
Opcode Fuzzy Hash: 0bc4211ff3559cfbc8cdfa33303a04b21ffa8fe43044cf814f80c683d3ac2f88
Instruction Fuzzy Hash: BFA114B160C3914FC319DF29C49062ABBE1EFD6310F19C66DE8E58B392D6359C01CB62

Function 0096FB60 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7511f0118684d37728360732e7c348e130a32dc3cdfef0ce7caecfb82e89da6b
Instruction ID: 9a6880d9399249bae18ad0d31c48f8926c30c0566edfe8ee593daea5bf04e8ff
Opcode Fuzzy Hash: 7511f0118684d37728360732e7c348e130a32dc3cdfef0ce7caecfb82e89da6b
Instruction Fuzzy Hash: 24913C32A082614FC726CE28D86035ABAD1ABD5364F19C27DE8B99B3D2D775DC46C3C1

Function 00990C80 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0737ca04a428b15ee7e171bba18bdf6b6e482c16c62c2a6884827abffedaf0ba
Instruction ID: da97b127cde781a0ecc4a910d996ffde143c56b269db8c007d6a51350a4eea2c
Opcode Fuzzy Hash: 0737ca04a428b15ee7e171bba18bdf6b6e482c16c62c2a6884827abffedaf0ba
Instruction Fuzzy Hash: 8B7113356083419FCB14AB2CD850B2FB7E6FFD8710F19892CE9958B2A4E7309D51C792

Function 009841D0 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ea5ccc39b85d2ae0f20985c59853f3d651c40b74325b5423baeb8b46a127c06
Instruction ID: afbcf1c70723cc6aec1896a9d7e18749e737a4670c39c7bcb3ec1f9cdac46060
Opcode Fuzzy Hash: 5ea5ccc39b85d2ae0f20985c59853f3d651c40b74325b5423baeb8b46a127c06
Instruction Fuzzy Hash: 2C714833B595A247CB189D7C4C122A9AA974FD633472EC37BAC76DB3E0D6298D014380

Function 0098B8E0 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bf3ec327dadaf1b32c7f534fbc51f3b45f9e069b2e6860db742ecabf39fe9ecf
Instruction ID: 628660cb8f549376c2134b4990447361fa9cbb9ee08c56c482a1e790389a3afc
Opcode Fuzzy Hash: bf3ec327dadaf1b32c7f534fbc51f3b45f9e069b2e6860db742ecabf39fe9ecf
Instruction Fuzzy Hash: 69513836A083108BD724AF29988166BB7E6EBD6720F2DC67CD9D567365E331DC028781

Function 00AA4FF6 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3cd0b352c9a20e85d1b1967b83adc1c4d2fdcc3949cfec58786ea42f60dbaa8
Instruction ID: 0d35447ae75a62c0783ab2d140b755750cdacad587b43497fabc153a8d99c578
Opcode Fuzzy Hash: f3cd0b352c9a20e85d1b1967b83adc1c4d2fdcc3949cfec58786ea42f60dbaa8
Instruction Fuzzy Hash: 545167F3A142205BE340592DDC8576BB7E9EBD4720F2A453EDA88D7744D9759C0282D2

Function 00970650 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4cb45dfc72640ab77c59be1606d5db093fd5bf26828c1f6ff1f24763d43ac01
Instruction ID: eefa152052507d286f2cd396cae0735a3c6611658647d51c29f2d5aff4acff35
Opcode Fuzzy Hash: c4cb45dfc72640ab77c59be1606d5db093fd5bf26828c1f6ff1f24763d43ac01
Instruction Fuzzy Hash: D5513737A1AAD0CBD7244D7C4C512A95A171BE6334B3EC36AD8B98B3D1C56B8D029391

Function 00AA74BA Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c26a9fa20263db0c7dc12f49007d94a658e7ed48ab7a6325735d188f0d3bc1e
Instruction ID: 258a0719d658d1e37f0e341d2768b98fb765958f8f2ee94576323837c077c7e0
Opcode Fuzzy Hash: 9c26a9fa20263db0c7dc12f49007d94a658e7ed48ab7a6325735d188f0d3bc1e
Instruction Fuzzy Hash: A1614CB7F1122447F3548E29CC943617393DBD9720F2F45788A48AB3C6E97E6C169384

Function 00A02C38 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259643028b4cb10270758a43318088c086f69bea6f311ce7a936a6633dad179d
Instruction ID: a5e725e2a915fffd923bb01cab108ad70092f20e56e1ad1feba880eff351fa7a
Opcode Fuzzy Hash: 259643028b4cb10270758a43318088c086f69bea6f311ce7a936a6633dad179d
Instruction Fuzzy Hash: 055178F3F182045FE304696DEC057BA7ADAEBE4221F1E453EE580C3748F979D8054652

Function 00ABEA6D Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20967786c334ec7a1f9b0a7be8d207487b03aae2ea6beffc806e7e250ca1f8c4
Instruction ID: badec68232b1e452a4f4fb565ce0754eacaac60f6fa9ace36ae1e5113f3e4a64
Opcode Fuzzy Hash: 20967786c334ec7a1f9b0a7be8d207487b03aae2ea6beffc806e7e250ca1f8c4
Instruction Fuzzy Hash: 4651F6F3E182049FE3046E2CDC4577AB7D6EBD4320F1A4A3DEAC5C3780E97998558686

Function 00971790 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ffe79af9ec09cbc78affb41e2582a3a21af3e645675cd4421bb2780e3c29493
Instruction ID: 09a287e6a820ac619135c3dda797a272d11dd9ac225bd82044059ef767725926
Opcode Fuzzy Hash: 5ffe79af9ec09cbc78affb41e2582a3a21af3e645675cd4421bb2780e3c29493
Instruction Fuzzy Hash: DD412932A1D344AFD3509F6CAC82A6B7BE8EBCA354F04883DF949C3281D634D8099753

Function 00A0F6B0 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6171af78cb589ea2f786f07d3760549b27f144527877f9cb27d801a282b6562a
Instruction ID: d09244eab893a1a1b2cdc30bb40feb0480385d61864c29495776044059b66cef
Opcode Fuzzy Hash: 6171af78cb589ea2f786f07d3760549b27f144527877f9cb27d801a282b6562a
Instruction Fuzzy Hash: CA4137F39082108BE7086E39DD5577EB7E6EB94720F2B463DDAC193284EE7848418786

Function 00AAD864 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5767332521781d622f37c3cd8866a1986280a7bb15ff3ee2c6d481f28b8c99e6
Instruction ID: 23f8b41b1a0f4d32c65834671ee8bb179aec4f210aff7c612d6c9d2cd993ce58
Opcode Fuzzy Hash: 5767332521781d622f37c3cd8866a1986280a7bb15ff3ee2c6d481f28b8c99e6
Instruction Fuzzy Hash: B541C4F2A085144FE704AA3DDE4532ABADADBD4710F2AC53DDAC4C7788E93859094686

Function 009827B0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96006c6248215eeefe07cffefb9b9843a7da1e1ce19442f8a11d3d053cf21f8f
Instruction ID: 4160b72e04f4b0f0e9806d77bb15653e4c65ef6be41bcf8a1c65708779a0135e
Opcode Fuzzy Hash: 96006c6248215eeefe07cffefb9b9843a7da1e1ce19442f8a11d3d053cf21f8f
Instruction Fuzzy Hash: 7B8172B411E3849BC774CF09D88869BBBE0BB9A308F10491DD88C8B3A0DFB01545DF96

Function 009527D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f70ce137f78f62f0fb9060444e8093c2442cc6ff0514dcf88eea3e59cc046e
Instruction ID: 51e185755a37b3fe14192c646d158d24232e89874062ff7b1d8598205f19fe45
Opcode Fuzzy Hash: 63f70ce137f78f62f0fb9060444e8093c2442cc6ff0514dcf88eea3e59cc046e
Instruction Fuzzy Hash: 8F11C437B3962147E350CFABDCD86566356EBCA311B1A0535EF41D7202C622E809E290

Function 00B9B3D4 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40ba1dbc3503473f030120c457623b4a7561b7ece2bb5845b6cf65c94c80af15
Instruction ID: 53f3c964d1126426bb5b3cc9cce6688209805e7422adee005af5b7b835a13fcb
Opcode Fuzzy Hash: 40ba1dbc3503473f030120c457623b4a7561b7ece2bb5845b6cf65c94c80af15
Instruction Fuzzy Hash: 9121E5B250C704AFE346AE68EC82BAAFBE5EB58310F16492DE2D5C2610E73594409A57

Function 0095BC9D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a782db349c2f56e36837ba339681c369eb1c59d9df0f2ba413b47b08682392
Instruction ID: 36ec09ba9e5746bacc9d8a4acab04b202dbb6f1aea800ea0a3d2e3860a0eb1c6
Opcode Fuzzy Hash: 47a782db349c2f56e36837ba339681c369eb1c59d9df0f2ba413b47b08682392
Instruction Fuzzy Hash: 6DF0277061C3804BD3198B28D89163FB7B0EB83604F10541DE3C2C32D2DB21C8069B09

Function 0098B860 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733414990.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 00950000, based on PE: true

Associated: 00000000.00000002.1733394041.0000000000950000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733414990.0000000000995000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733482635.00000000009A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.00000000009A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733501177.0000000000C52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733812558.0000000000C53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733944953.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1733967926.0000000000DEF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d41819a9642c843735be8b4a93df8c2ba0a1f6c7d79a1da51ae6c7ccc4b422ae
Instruction ID: dde87bacb22c8d1bdaa324b8517cdcf5e423618c15203e8581d33b2431a93803
Opcode Fuzzy Hash: d41819a9642c843735be8b4a93df8c2ba0a1f6c7d79a1da51ae6c7ccc4b422ae
Instruction Fuzzy Hash: 5FB09250A282087F00249D0E8C45D7BB6BE92CB640B10600DA408A32148650EC0482FA

Source: https://cook-rain.sbs/apiOn	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs:443/api-	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/Q	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/api%	Avira URL Cloud: Label: malware

Source: 00000000.00000003.1690148012.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String decryptor: p3ar11fter.sbs
Source: 00000000.00000003.1690148012.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String decryptor: 3xp3cts1aim.sbs
Source: 00000000.00000003.1690148012.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String decryptor: peepburry828.sbs
Source: 00000000.00000003.1690148012.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String decryptor: p10tgrace.sbs
Source: 00000000.00000003.1690148012.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String decryptor: processhol.sbs
Source: 00000000.00000003.1690148012.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.1690148012.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.1690148012.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.1690148012.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.1690148012.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -

Source: Network traffic	Suricata IDS: 2057730 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs) : 192.168.2.4:54395 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:49730 -> 104.21.66.38:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:49731 -> 104.21.66.38:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 104.21.66.38:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 104.21.66.38:443

Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: peepburry828.sbs

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 104.21.66.38:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.66.38:443

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [eax], bl	0_2_0095CF05
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push eax	0_2_0098F8D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, eax	0_2_0098F8D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, byte ptr [esp+esi+000001E8h]	0_2_0095E0D8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+14h]	0_2_009598F0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, eax	0_2_0098B8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, ecx	0_2_0098B8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, eax	0_2_0095C02B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 98D5A07Fh	0_2_0098C040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], C18BC4BAh	0_2_0098C040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 6DBC3610h	0_2_0098C040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 98D5A07Fh	0_2_0098C040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00970870
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push eax	0_2_0098B860
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+14h]	0_2_0095E970
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], cx	0_2_0095EA38
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-65h]	0_2_0095E35B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, ebp	0_2_00955C90
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, ebp	0_2_00955C90
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, ecx	0_2_0095BC9D
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_00978CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 4C697C35h	0_2_0098BCE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx]	0_2_0095AD00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [edi]	0_2_00975E90
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx+00008F12h]	0_2_009577D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [ebp+ebx*4+00h], ax	0_2_009577D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-58FA0F6Ch]	0_2_00990F60

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
file.exe

Function 00989030 Relevance: 21.6, APIs: 5, Strings: 7, Instructions: 629
memoryCOMMON

Function 0095CF05 Relevance: 18.1, Strings: 14, Instructions: 574
COMMON

Function 009589A0 Relevance: 1.8, APIs: 1, Instructions: 252
COMMON

Function 0098DF70 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 0098B7E0 Relevance: 1.5, APIs: 1, Instructions: 49
memoryCOMMON

Function 0095CE80 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Function 0095CEB3 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Function 0095D7D3 Relevance: 1.3, APIs: 1, Instructions: 8
COMMON