Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1526904
MD5:	b6ef24e90b59608f2b6765e5f07ad8e3
SHA1:	b3b4539c0c6bf4027df6a9bac4a84afa51ca105c
SHA256:	5b8c002435003ad4e6a178b9aaef6e398d6491ff080857550deb71fbfefb3a9d
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6100 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B6EF24E90B59608F2B6765E5F07AD8E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["spirittunek.stor", "mobbipenju.stor", "bathdoomgaz.stor", "clearancek.site", "eaglepawnoy.stor", "studennotediw.stor", "dissapoiznw.stor", "licendfilteo.site"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T17:48:03.736103+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	53670	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T17:48:03.535972+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	57909	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T17:48:03.576767+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	55805	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T17:48:03.564570+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	61232	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T17:48:03.770399+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	53801	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T17:48:03.553253+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	59721	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T17:48:03.754565+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	63037	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-06T17:48:03.675143+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	65336	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900

URL Reputation: Label: malware

Found malware configuration

Source: file.exe.6100.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["spirittunek.stor", "mobbipenju.stor", "bathdoomgaz.stor", "clearancek.site", "eaglepawnoy.stor", "studennotediw.stor", "dissapoiznw.stor", "licendfilteo.site"], "Build id": "4SD0y4--legendaryy"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.stor
Source: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.stor
Source: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.stor
Source: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.stor
Source: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.stor
Source: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.stor
Source: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00AF50FA
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00ABD110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00ABD110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_00AF63B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00AF5700
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00AF99D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_00AF695B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_00ABFCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00AF6094
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00AC6F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then dec ebx	0_2_00AEF030
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_00AB1000
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00AF4040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00ADD1E1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00AC42FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00AD2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00AD2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00AE23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00AE23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00AE23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00AE23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00AE23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_00AE23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	0_2_00ABA300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_00AF64B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00ADE40C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_00ACB410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00ADC470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_00AF1440
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00ACD457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_00AF7520
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00AC6536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00AD9510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00ADE66A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00AEB650
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00ADD7AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_00AF67EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_00AF7710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00AD28E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_00AB49A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00AF3920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_00ACD961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00AC1ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00AC1A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00AF4A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00AB5A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00AE0B80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00AC1BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00AC3BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_00ACDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_00ACDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00AF9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00ADAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_00ADAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00AF9CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00AF9CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_00ADCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00ADCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_00ADCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_00AEFC20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00AD7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_00ADEC48
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00AF8D8A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00ADDD29
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_00ADFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_00AB6EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_00AC6EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_00ABBEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00AC1E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00AC0EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, ecx	0_2_00AC4E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00AD7E60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00AD5E70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_00ADAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00AC6F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00AF7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00AF7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_00ACFFDF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00AF5FD6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00AB8FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00AD9F62
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00AEFF70

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:57909 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:55805 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:65336 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:53670 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:63037 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:59721 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:53801 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:61232 -> 1.1.1.1:53

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: spirittunek.stor
Source: Malware configuration extractor	URLs: mobbipenju.stor
Source: Malware configuration extractor	URLs: bathdoomgaz.stor
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: eaglepawnoy.stor
Source: Malware configuration extractor	URLs: studennotediw.stor
Source: Malware configuration extractor	URLs: dissapoiznw.stor
Source: Malware configuration extractor	URLs: licendfilteo.site

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000002.1759749334.000000000062A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https:/ equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=55ee334b130c2eef734da2b0; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type25489Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveSun, 06 Oct 2024 15:48:04 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000000.00000002.1759661432.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store:443/api
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759749334.000000000062A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759749334.000000000062A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000000.00000002.1759661432.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/apibcryptPrimitives.dll
Source: file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759526066.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759526066.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759526066.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759526066.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: file.exe, 00000000.00000002.1759661432.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dissapoiznw.store:443/apiW
Source: file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000000.00000002.1759661432.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site:443/api
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000000.00000002.1759661432.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobbipenju.store:443/api
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759749334.000000000062A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759749334.000000000062A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: file.exe, 00000000.00000002.1759661432.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store:443/api
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759526066.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000002.1759661432.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/g
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759526066.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/p
Source: file.exe, 00000000.00000002.1759661432.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000002.1759661432.00000000005E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738065074.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900p
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000002.1759661432.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900_
Source: file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f
Source: file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759749334.000000000062A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759749334.000000000062A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759749334.000000000062A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759749334.000000000062A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC0228	0_2_00AC0228
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFA0D0	0_2_00AFA0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC2030	0_2_00AC2030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB1000	0_2_00AB1000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF4040	0_2_00AF4040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7	0_2_00C791C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABE1A0	0_2_00ABE1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB71F0	0_2_00AB71F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C74103	0_2_00C74103
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB5160	0_2_00AB5160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA92FE	0_2_00BA92FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB12F7	0_2_00AB12F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE82D0	0_2_00AE82D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE12D0	0_2_00AE12D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB13A3	0_2_00AB13A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABB3A0	0_2_00ABB3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE23E0	0_2_00AE23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABA300	0_2_00ABA300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC4487	0_2_00AC4487
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC049B	0_2_00AC049B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE64F0	0_2_00AE64F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C88446	0_2_00C88446
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBF40E	0_2_00BBF40E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADC470	0_2_00ADC470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB35B0	0_2_00AB35B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D515F5	0_2_00D515F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACC5F0	0_2_00ACC5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF86F0	0_2_00AF86F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C776AA	0_2_00C776AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AEF620	0_2_00AEF620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C0F601	0_2_00C0F601
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB164F	0_2_00AB164F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF8652	0_2_00AF8652
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C807C4	0_2_00C807C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE4725	0_2_00BE4725
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AEE8A0	0_2_00AEE8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C818FB	0_2_00C818FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD78DA	0_2_00BD78DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AEB8C0	0_2_00AEB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE1860	0_2_00AE1860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D9983D	0_2_00D9983D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF89A0	0_2_00AF89A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD098B	0_2_00AD098B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B349C3	0_2_00B349C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4E93D	0_2_00B4E93D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C86935	0_2_00C86935
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE9ACD	0_2_00CE9ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF7AB0	0_2_00AF7AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF8A80	0_2_00AF8A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8BA24	0_2_00C8BA24
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF4A40	0_2_00AF4A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB7BF0	0_2_00AB7BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACDB6F	0_2_00ACDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF6CBF	0_2_00AF6CBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C75C84	0_2_00C75C84
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADCCD0	0_2_00ADCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF8C02	0_2_00AF8C02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADDD29	0_2_00ADDD29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADFD10	0_2_00ADFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD8D62	0_2_00AD8D62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC6EBF	0_2_00AC6EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABBEB0	0_2_00ABBEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC4E2A	0_2_00AC4E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF8E70	0_2_00AF8E70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADAE57	0_2_00ADAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF7FC0	0_2_00AF7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB8FD0	0_2_00AB8FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABAF10	0_2_00ABAF10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C84F0F	0_2_00C84F0F

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00ACD300 appears 152 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00ABCAA0 appears 48 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9996067966171617
Source: file.exe	Static PE information: Section: psmjilnq ZLIB complexity 0.993955830667956

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@9/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AE8220 CoCreateInstance,

0_2_00AE8220

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior

Source: file.exe

Static file information: File size 1890816 > 1048576

Source: file.exe

Static PE information: Raw size of psmjilnq is bigger than: 0x100000 < 0x1a4200

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.ab0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;psmjilnq:EW;fwpdehgj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;psmjilnq:EW;fwpdehgj:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cf52f should be: 0x1db74e

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: psmjilnq
Source: file.exe	Static PE information: section name: fwpdehgj
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE30C5 push 7FAAED32h; mov dword ptr [esp], ebx	0_2_00CE30D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BFD0E8 push eax; mov dword ptr [esp], 1FDE62F2h	0_2_00BFD0FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BFD0E8 push ecx; mov dword ptr [esp], esi	0_2_00BFD198
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BFD0E8 push 0E1849C4h; mov dword ptr [esp], ecx	0_2_00BFD1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D960BA push ebx; mov dword ptr [esp], edx	0_2_00D960FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5E0A1 push ebp; mov dword ptr [esp], edx	0_2_00D5E0F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5E0A1 push 42844BFFh; mov dword ptr [esp], edi	0_2_00D5E115
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D51071 push esi; mov dword ptr [esp], edi	0_2_00D51117
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D51071 push 22B602B0h; mov dword ptr [esp], ebx	0_2_00D51131
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CEE06B push ebp; mov dword ptr [esp], eax	0_2_00CEE0A7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2501B push eax; mov dword ptr [esp], edx	0_2_00D25040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2501B push edx; mov dword ptr [esp], ecx	0_2_00D2505C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D76007 push 3F6DD215h; mov dword ptr [esp], esi	0_2_00D760A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7 push 4D79080Dh; mov dword ptr [esp], edx	0_2_00C7922D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7 push ecx; mov dword ptr [esp], esi	0_2_00C79272
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7 push edx; mov dword ptr [esp], edi	0_2_00C792F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7 push esi; mov dword ptr [esp], 66CA1803h	0_2_00C79338
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7 push esi; mov dword ptr [esp], eax	0_2_00C7941E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7 push 2838B974h; mov dword ptr [esp], edi	0_2_00C79444
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7 push ecx; mov dword ptr [esp], eax	0_2_00C794E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7 push 59B12189h; mov dword ptr [esp], esp	0_2_00C794EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7 push ecx; mov dword ptr [esp], ebx	0_2_00C79530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7 push 0BC444EBh; mov dword ptr [esp], eax	0_2_00C795A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7 push ebp; mov dword ptr [esp], esi	0_2_00C795B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7 push edx; mov dword ptr [esp], edi	0_2_00C795D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7 push eax; mov dword ptr [esp], ebp	0_2_00C795EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7 push 223118A5h; mov dword ptr [esp], eax	0_2_00C79639
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7 push ebp; mov dword ptr [esp], 5A95CC42h	0_2_00C79642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7 push 484C72CAh; mov dword ptr [esp], esi	0_2_00C79656
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7 push ebx; mov dword ptr [esp], 668C6272h	0_2_00C79668
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C791C7 push edi; mov dword ptr [esp], edx	0_2_00C796C6

Source: file.exe	Static PE information: section name: entropy: 7.9848772918639925
Source: file.exe	Static PE information: section name: psmjilnq entropy: 7.954517052404453

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9258D second address: C92593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C92593 second address: C9259C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9259C second address: C925A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C918D4 second address: C918D9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C918D9 second address: C918DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C91B62 second address: C91B68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C91CA4 second address: C91CB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F7D80D626BFh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C91CB8 second address: C91CCD instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7D81146DDCh 0x00000008 jns 00007F7D81146DD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C91CCD second address: C91CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jl 00007F7D80D626B6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C91CDA second address: C91CDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C91CDF second address: C91CE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C91CE7 second address: C91CED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C949E2 second address: C94A4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D80D626C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F7D80D626BBh 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007F7D80D626C3h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push edi 0x0000001e jl 00007F7D80D626BCh 0x00000024 jo 00007F7D80D626B6h 0x0000002a pop edi 0x0000002b pop eax 0x0000002c mov ecx, 072D6171h 0x00000031 lea ebx, dword ptr [ebp+124547E1h] 0x00000037 mov dword ptr [ebp+122D39B2h], edi 0x0000003d mov si, di 0x00000040 xchg eax, ebx 0x00000041 jl 00007F7D80D626C4h 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94A4C second address: C94A5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F7D81146DD6h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94A5D second address: C94A6B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7D80D626B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C899E0 second address: C899EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F7D81146DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C899EA second address: C899EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C899EE second address: C89A09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7D81146DE0h 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB4135 second address: CB4146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7D80D626BBh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB4146 second address: CB414A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB414A second address: CB414E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB414E second address: CB4154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB42C1 second address: CB42CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB42CB second address: CB42CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB485E second address: CB4862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB4B5E second address: CB4B7D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F7D81146DDAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB4B7D second address: CB4B87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F7D80D626B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB4B87 second address: CB4B99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D81146DDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB4B99 second address: CB4BA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F7D80D626B6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB4E44 second address: CB4E4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB4FA6 second address: CB4FB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F7D80D626BCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB4FB6 second address: CB4FBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB4FBA second address: CB5016 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D80D626C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7D80D626C9h 0x00000010 pushad 0x00000011 jmp 00007F7D80D626BDh 0x00000016 push edx 0x00000017 pop edx 0x00000018 jo 00007F7D80D626B6h 0x0000001e jmp 00007F7D80D626C0h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB514E second address: CB5156 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C78D15 second address: C78D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7D80D626B6h 0x0000000a pushad 0x0000000b jmp 00007F7D80D626BFh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5272 second address: CB52A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F7D81146DE0h 0x0000000b popad 0x0000000c pop ebx 0x0000000d pushad 0x0000000e pushad 0x0000000f jno 00007F7D81146DD6h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 jmp 00007F7D81146DDBh 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB52A4 second address: CB52AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F7D80D626B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB52AE second address: CB52C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D81146DDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5852 second address: CB5856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5856 second address: CB5884 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D81146DE4h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F7D81146DE4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5884 second address: CB5888 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5888 second address: CB588E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5B09 second address: CB5B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jnl 00007F7D80D626C6h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7D80D626C4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5CA1 second address: CB5CA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5CA5 second address: CB5CB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F7D80D626B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5CB3 second address: CB5CBD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7D81146DD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5CBD second address: CB5CC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5CC3 second address: CB5CC8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5F97 second address: CB5FA1 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7D80D626B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5FA1 second address: CB5FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7D81146DE9h 0x0000000c jbe 00007F7D81146DD6h 0x00000012 ja 00007F7D81146DD6h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5FCE second address: CB6001 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D80D626C9h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7D80D626C4h 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6001 second address: CB600B instructions: 0x00000000 rdtsc 0x00000002 js 00007F7D81146DD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C84A0D second address: C84A32 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7D80D626B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c jnp 00007F7D80D626B6h 0x00000012 jmp 00007F7D80D626BDh 0x00000017 pop ebx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBD88E second address: CBD899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7D81146DD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBDF32 second address: CBDF36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE13D second address: CBE142 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C864AC second address: C864B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC0E55 second address: CC0E82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D81146DE5h 0x00000007 jmp 00007F7D81146DE0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC0E82 second address: CC0E87 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC0E87 second address: CC0E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC0E8D second address: CC0E97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1179 second address: CC118F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D81146DDAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC118F second address: CC119E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC119E second address: CC11A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC11A2 second address: CC11B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F7D80D626B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F7D80D626B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC11B6 second address: CC11C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F7D81146DD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2CC6 second address: CC2CCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2CCE second address: CC2CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4C3E second address: CC4C42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC58B5 second address: CC58BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6660 second address: CC666A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F7D80D626B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6FC9 second address: CC6FDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7D81146DE1h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6FDF second address: CC6FE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC82E4 second address: CC82E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6FE5 second address: CC6FE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC82E9 second address: CC82F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F7D81146DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC82F3 second address: CC82F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA408 second address: CCA427 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D81146DE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA1FB second address: CCA216 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7D80D626C7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC96FE second address: CC9703 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA427 second address: CCA42B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9703 second address: CC9727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jnp 00007F7D81146DE3h 0x0000000f jmp 00007F7D81146DDDh 0x00000014 push eax 0x00000015 push edx 0x00000016 jns 00007F7D81146DD6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA42B second address: CCA42F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF188 second address: CCF18D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2EFD second address: CD2F01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2F01 second address: CD2F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD3F6F second address: CD3F8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D80D626C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD1FF3 second address: CD1FF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD30F5 second address: CD30F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD30F9 second address: CD318C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F7D81146DD8h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 0000001Dh 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 mov bh, 66h 0x00000023 push dword ptr fs:[00000000h] 0x0000002a mov ebx, dword ptr [ebp+122D5AF5h] 0x00000030 mov dword ptr fs:[00000000h], esp 0x00000037 push 00000000h 0x00000039 push eax 0x0000003a call 00007F7D81146DD8h 0x0000003f pop eax 0x00000040 mov dword ptr [esp+04h], eax 0x00000044 add dword ptr [esp+04h], 00000014h 0x0000004c inc eax 0x0000004d push eax 0x0000004e ret 0x0000004f pop eax 0x00000050 ret 0x00000051 stc 0x00000052 mov eax, dword ptr [ebp+122D071Dh] 0x00000058 jnl 00007F7D81146DDCh 0x0000005e movsx edi, ax 0x00000061 push FFFFFFFFh 0x00000063 add bl, 0000000Ch 0x00000066 push eax 0x00000067 jnp 00007F7D81146DF3h 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007F7D81146DE1h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD318C second address: CD3190 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD60AB second address: CD60B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F7D81146DD6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6EA2 second address: CD6EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6EAE second address: CD6EB4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD60B8 second address: CD6158 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D80D626C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d jc 00007F7D80D626BCh 0x00000013 xor ebx, dword ptr [ebp+122D19F2h] 0x00000019 push dword ptr fs:[00000000h] 0x00000020 and bh, 00000078h 0x00000023 jmp 00007F7D80D626C1h 0x00000028 mov dword ptr fs:[00000000h], esp 0x0000002f mov dword ptr [ebp+122D1AEDh], esi 0x00000035 call 00007F7D80D626C8h 0x0000003a pop edi 0x0000003b mov eax, dword ptr [ebp+122D1191h] 0x00000041 push 00000000h 0x00000043 push ebx 0x00000044 call 00007F7D80D626B8h 0x00000049 pop ebx 0x0000004a mov dword ptr [esp+04h], ebx 0x0000004e add dword ptr [esp+04h], 00000018h 0x00000056 inc ebx 0x00000057 push ebx 0x00000058 ret 0x00000059 pop ebx 0x0000005a ret 0x0000005b mov ebx, dword ptr [ebp+12482E5Fh] 0x00000061 push FFFFFFFFh 0x00000063 mov edi, 067C8F9Bh 0x00000068 push eax 0x00000069 push ecx 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6158 second address: CD615C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9036 second address: CD903C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD819D second address: CD81A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD903C second address: CD90B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 je 00007F7D80D626B6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jng 00007F7D80D626BEh 0x00000015 push eax 0x00000016 jc 00007F7D80D626B6h 0x0000001c pop eax 0x0000001d nop 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007F7D80D626B8h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 0000001Dh 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 mov dword ptr [ebp+12453598h], ecx 0x0000003e push 00000000h 0x00000040 mov edi, dword ptr [ebp+122D39FDh] 0x00000046 push 00000000h 0x00000048 mov bl, EAh 0x0000004a xchg eax, esi 0x0000004b push ecx 0x0000004c jmp 00007F7D80D626C3h 0x00000051 pop ecx 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 je 00007F7D80D626B8h 0x0000005b pushad 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDA04A second address: CDA04E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDA04E second address: CDA057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDA057 second address: CDA0CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F7D81146DDEh 0x0000000c nop 0x0000000d mov ebx, 0A06A3BAh 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F7D81146DD8h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e mov dword ptr [ebp+12480C29h], ebx 0x00000034 push 00000000h 0x00000036 mov di, 3D41h 0x0000003a xchg eax, esi 0x0000003b pushad 0x0000003c push eax 0x0000003d jp 00007F7D81146DD6h 0x00000043 pop eax 0x00000044 push ecx 0x00000045 jmp 00007F7D81146DDEh 0x0000004a pop ecx 0x0000004b popad 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f jnl 00007F7D81146DDCh 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDA0CF second address: CDA0D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBF68 second address: CDC02E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D81146DE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F7D81146DD8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov di, 6653h 0x00000028 call 00007F7D81146DDDh 0x0000002d call 00007F7D81146DE9h 0x00000032 mov edi, dword ptr [ebp+122D190Dh] 0x00000038 pop ebx 0x00000039 pop edi 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push edi 0x0000003f call 00007F7D81146DD8h 0x00000044 pop edi 0x00000045 mov dword ptr [esp+04h], edi 0x00000049 add dword ptr [esp+04h], 0000001Bh 0x00000051 inc edi 0x00000052 push edi 0x00000053 ret 0x00000054 pop edi 0x00000055 ret 0x00000056 push 00000000h 0x00000058 mov bx, di 0x0000005b xchg eax, esi 0x0000005c jmp 00007F7D81146DE6h 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 jmp 00007F7D81146DDDh 0x0000006a jnp 00007F7D81146DD6h 0x00000070 popad 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDB252 second address: CDB269 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D80D626BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F7D80D626B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDB269 second address: CDB291 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7D81146DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F7D81146DE8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDB291 second address: CDB297 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDB297 second address: CDB2B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7D81146DE7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD92B7 second address: CD92BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE0E0 second address: CDE0E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE0E5 second address: CDE11D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7D80D626C2h 0x00000008 jmp 00007F7D80D626C9h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD26C second address: CDD270 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD270 second address: CDD315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F7D80D626BCh 0x0000000c popad 0x0000000d nop 0x0000000e mov edi, edx 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007F7D80D626B8h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 jmp 00007F7D80D626C1h 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d push 00000000h 0x0000003f push ebp 0x00000040 call 00007F7D80D626B8h 0x00000045 pop ebp 0x00000046 mov dword ptr [esp+04h], ebp 0x0000004a add dword ptr [esp+04h], 0000001Ah 0x00000052 inc ebp 0x00000053 push ebp 0x00000054 ret 0x00000055 pop ebp 0x00000056 ret 0x00000057 add bl, 0000007Dh 0x0000005a mov eax, dword ptr [ebp+122D0635h] 0x00000060 jmp 00007F7D80D626C0h 0x00000065 push FFFFFFFFh 0x00000067 jmp 00007F7D80D626C1h 0x0000006c push eax 0x0000006d push edi 0x0000006e push eax 0x0000006f push edx 0x00000070 push edx 0x00000071 pop edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDC20D second address: CDC218 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F7D81146DD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE32B second address: CDE32F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE32F second address: CDE355 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D81146DE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2143 second address: CE2152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F7D80D626B6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2152 second address: CE2156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2156 second address: CE215A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE215A second address: CE2160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CFA5 second address: C8CFA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CFA9 second address: C8CFCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D81146DE0h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F7D81146DDEh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7DD4F second address: C7DD6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D80D626C5h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9607 second address: CE960B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE976C second address: CE9772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9772 second address: CE9776 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9776 second address: CE978A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7D80D626BEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC1B7 second address: CEC1BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF065A second address: CF0681 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7D80D626C6h 0x00000008 jmp 00007F7D80D626C0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 je 00007F7D80D626BCh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0681 second address: CF0689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0689 second address: CF068D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF068D second address: CF06A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7D81146DE0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0779 second address: CF077F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF077F second address: CF0783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0783 second address: CF0787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF08E8 second address: CF0956 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D81146DDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F7D81146DE6h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jne 00007F7D81146DDEh 0x00000019 mov eax, dword ptr [eax] 0x0000001b jnl 00007F7D81146DE4h 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F7D81146DE4h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0956 second address: CF0960 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7D80D626B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8B524 second address: C8B52E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F7D81146DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8B52E second address: C8B54E instructions: 0x00000000 rdtsc 0x00000002 je 00007F7D80D626B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F7D80D626C0h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5307 second address: CF5311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF58D7 second address: CF58E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF58E1 second address: CF58E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5CFE second address: CF5D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7D80D626BEh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6265 second address: CF6271 instructions: 0x00000000 rdtsc 0x00000002 js 00007F7D81146DD6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE5F3 second address: CFE5FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F7D80D626B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE767 second address: CFE7A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D81146DE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jng 00007F7D81146DEEh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jbe 00007F7D81146DD6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE7A4 second address: CFE7A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE8E3 second address: CFE8EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE8EE second address: CFE90A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7D80D626C8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFEC3A second address: CFEC3F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE2ED second address: CFE2F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE2F6 second address: CFE312 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F7D81146DE5h 0x00000008 pop ecx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE312 second address: CFE32A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F7D80D626B6h 0x00000012 jp 00007F7D80D626B6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE32A second address: CFE352 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D81146DDDh 0x00000007 jbe 00007F7D81146DD6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F7D81146DDEh 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF075 second address: CFF079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF079 second address: CFF089 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jbe 00007F7D81146DD6h 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF089 second address: CFF0A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7D80D626C4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF1FB second address: CFF20E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7D81146DDDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF367 second address: CFF36C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF36C second address: CFF382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7D81146DE2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF639 second address: CFF63D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF63D second address: CFF658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7D81146DDBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jnc 00007F7D81146DD6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF658 second address: CFF66A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D80D626BEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF66A second address: CFF699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F7D81146DDAh 0x0000000c push edx 0x0000000d pop edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F7D81146DE7h 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF699 second address: CFF6A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF6A0 second address: CFF6B6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7D81146DDCh 0x00000008 jo 00007F7D81146DDEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0418D second address: D041B3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jne 00007F7D80D626B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007F7D80D626BEh 0x00000012 popad 0x00000013 jnp 00007F7D80D626C0h 0x00000019 push edx 0x0000001a push eax 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04469 second address: D0446F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04739 second address: D0473F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04878 second address: D0489D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7D81146DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F7D81146DEBh 0x00000010 jmp 00007F7D81146DE5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0489D second address: D048A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F7D80D626B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D048A8 second address: D048B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jl 00007F7D81146DF1h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D048B7 second address: D04906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7D80D626C5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F7D80D626C7h 0x00000011 jmp 00007F7D80D626C7h 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04A63 second address: D04A6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F7D81146DD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04D01 second address: D04D07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04D07 second address: D04D1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7D81146DE1h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04D1D second address: D04D23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04D23 second address: D04D38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 js 00007F7D81146DD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jl 00007F7D81146DD6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04D38 second address: D04D44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F7D80D626B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CABADC second address: CABAE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CABAE0 second address: CABAE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CABAE4 second address: CABAEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C82F8D second address: C82FAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F7D80D626B6h 0x00000009 jmp 00007F7D80D626C4h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C82FAC second address: C82FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a js 00007F7D81146DDCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C82FBE second address: C82FCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F7D80D626BEh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03D0B second address: D03D34 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7D81146DDEh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jne 00007F7D81146DD6h 0x00000010 push esi 0x00000011 jmp 00007F7D81146DE6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0847B second address: D08492 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D80D626C3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0D9E2 second address: D0D9E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0D9E6 second address: D0DA19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7D80D626C4h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f jc 00007F7D80D626B6h 0x00000015 pop edx 0x00000016 jnc 00007F7D80D626BEh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0DA19 second address: D0DA34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7D81146DE5h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCD6F1 second address: CCD6F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCDD47 second address: CCDD86 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F7D81146DE4h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 47EF91FBh 0x00000012 mov cx, 79CDh 0x00000016 push ecx 0x00000017 pushad 0x00000018 mov ecx, 7E957AB7h 0x0000001d push edx 0x0000001e pop ecx 0x0000001f popad 0x00000020 pop edi 0x00000021 push 4F9648D7h 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jns 00007F7D81146DD6h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCDD86 second address: CCDD8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCDD8A second address: CCDD90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCDEE3 second address: CCDEEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F7D80D626B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCDEEE second address: CCDF27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, esi 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F7D81146DD8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F7D81146DDAh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE032 second address: CCE046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jl 00007F7D80D626C8h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE046 second address: CCE04A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE04A second address: CCE04E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE1E2 second address: CCE206 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F7D81146DD8h 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F7D81146DDFh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE206 second address: CCE20B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE9B2 second address: CCEA00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D81146DDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jg 00007F7D81146DDEh 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jmp 00007F7D81146DE2h 0x00000019 mov eax, dword ptr [eax] 0x0000001b jmp 00007F7D81146DDCh 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 push ecx 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEA92 second address: CCEAB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F7D80D626BAh 0x0000000c nop 0x0000000d lea eax, dword ptr [ebp+1248D47Eh] 0x00000013 mov ecx, dword ptr [ebp+122D24ADh] 0x00000019 nop 0x0000001a push ecx 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEAB5 second address: CCEAC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEAC0 second address: CABADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 xor ecx, dword ptr [ebp+122D2C4Fh] 0x0000000d lea eax, dword ptr [ebp+1248D43Ah] 0x00000013 jmp 00007F7D80D626BBh 0x00000018 push eax 0x00000019 jmp 00007F7D80D626BBh 0x0000001e mov dword ptr [esp], eax 0x00000021 jmp 00007F7D80D626C7h 0x00000026 call dword ptr [ebp+122D5A7Eh] 0x0000002c js 00007F7D80D626E7h 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F7D80D626BBh 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D112C4 second address: D112E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7D81146DE9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1155D second address: D11561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D11561 second address: D1156C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1156C second address: D11572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D11AD3 second address: D11ADE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jno 00007F7D81146DD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D149D1 second address: D149D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D149D5 second address: D149F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F7D81146DD6h 0x0000000e jmp 00007F7D81146DE5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D172DF second address: D172EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F7D80D626B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D172EB second address: D172F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 js 00007F7D81146DD6h 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D172F8 second address: D17300 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C1C4 second address: D1C1C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C2FF second address: D1C305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C305 second address: D1C309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C309 second address: D1C319 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7D80D626B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C4A3 second address: D1C4A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1FDDF second address: D1FDFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jmp 00007F7D80D626C3h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1FDFC second address: D1FE04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2048E second address: D20492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20492 second address: D20496 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D205E3 second address: D205E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C75727 second address: C7572D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D250A2 second address: D250A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D250A8 second address: D250AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D250AC second address: D250B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D250B2 second address: D250D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jnl 00007F7D81146DDEh 0x00000011 pushad 0x00000012 je 00007F7D81146DD6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25233 second address: D25242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jo 00007F7D80D626BCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25389 second address: D2538F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2538F second address: D253AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 jbe 00007F7D80D626B6h 0x0000000e push edi 0x0000000f pop edi 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 js 00007F7D80D626B6h 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2551C second address: D25522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25522 second address: D2553D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7D80D626BAh 0x00000008 pushad 0x00000009 jo 00007F7D80D626B6h 0x0000000f jg 00007F7D80D626B6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26556 second address: D26560 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7D81146DD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F666 second address: D2F679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7D80D626BFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D80B second address: D2D823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7D81146DE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D823 second address: D2D83E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F7D80D626B6h 0x00000009 jnl 00007F7D80D626B6h 0x0000000f jc 00007F7D80D626B6h 0x00000015 popad 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D998 second address: D2D99C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D99C second address: D2D9AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F7D80D626BCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2DDF2 second address: D2DDF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E5F9 second address: D2E60B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7D80D626B8h 0x00000008 jc 00007F7D80D626C2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E60B second address: D2E611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E8C6 second address: D2E8F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F7D80D626D1h 0x0000000b popad 0x0000000c pushad 0x0000000d jng 00007F7D80D626BCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EE1D second address: D2EE39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jno 00007F7D81146DD6h 0x0000000c popad 0x0000000d jnp 00007F7D81146DDCh 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EE39 second address: D2EE43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F2DC second address: D2F2F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D81146DE1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F2F1 second address: D2F2FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F2FA second address: D2F300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F300 second address: D2F31D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F7D80D626B6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F7D80D626BEh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30D08 second address: D30D20 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F7D81146DDDh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30D20 second address: D30D24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34C51 second address: D34C55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34C55 second address: D34C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33F11 second address: D33F21 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7D81146DD6h 0x00000008 jno 00007F7D81146DD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D340C1 second address: D340C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D340C7 second address: D340CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34241 second address: D34245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34545 second address: D34549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34549 second address: D3455F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F7D80D626BAh 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D396F1 second address: D396FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4054F second address: D40553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D40553 second address: D40571 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007F7D81146DD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007F7D81146DE2h 0x00000012 push edx 0x00000013 pop edx 0x00000014 jmp 00007F7D81146DDAh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D40571 second address: D4057B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7D80D626BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4057B second address: D40586 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D40586 second address: D4058C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4058C second address: D40597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F7D81146DD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D40597 second address: D405B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7D80D626C8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D405B5 second address: D405B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D40BEB second address: D40BEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D40BEF second address: D40C29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D81146DE2h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7D81146DE3h 0x0000000e jmp 00007F7D81146DE1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D40F14 second address: D40F18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41318 second address: D4131C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41A77 second address: D41A8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7D80D626C4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41A8F second address: D41A93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42206 second address: D4220C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B7D1 second address: D4B7D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B98F second address: D4B993 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D591DC second address: D5920D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7D81146DE0h 0x00000009 pop esi 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7D81146DE2h 0x00000013 je 00007F7D81146DD6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B974 second address: D5B9A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F7D80D626CBh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7D80D626C1h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E162 second address: D5E167 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E167 second address: D5E186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pushad 0x00000008 jmp 00007F7D80D626C5h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E186 second address: D5E18C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64121 second address: D6412E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F7D80D626BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DD94 second address: D6DDB2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007F7D81146DD6h 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007F7D81146DD6h 0x00000018 ja 00007F7D81146DD6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DDB2 second address: D6DDB8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DDB8 second address: D6DDD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D81146DE8h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DDD5 second address: D6DDDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DBE3 second address: D6DC13 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7D81146DD6h 0x00000008 jng 00007F7D81146DD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jg 00007F7D81146DEAh 0x00000016 pop edi 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DC13 second address: D6DC19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D752A9 second address: D752B3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7D81146DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D752B3 second address: D752D8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7D80D626CAh 0x00000008 jmp 00007F7D80D626C2h 0x0000000d push eax 0x0000000e pop eax 0x0000000f push ecx 0x00000010 jnl 00007F7D80D626B6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75440 second address: D75444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79662 second address: D79666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97B96 second address: D97B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97B9C second address: D97BA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97BA0 second address: D97BBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D81146DE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97D23 second address: D97D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97D29 second address: D97D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7D81146DE8h 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F7D81146DDBh 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97D58 second address: D97D5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0A85 second address: DB0A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7D81146DDFh 0x00000009 pop ecx 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0A9F second address: DB0AB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F7D80D626B6h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1373 second address: DB1378 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB17B6 second address: DB17D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7D80D626BFh 0x00000008 jnl 00007F7D80D626B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB197C second address: DB1981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB784E second address: DB7852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7852 second address: DB78C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7D81146DE0h 0x0000000c jng 00007F7D81146DD6h 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 jmp 00007F7D81146DDDh 0x0000001a nop 0x0000001b pushad 0x0000001c or esi, dword ptr [ebp+122D1A07h] 0x00000022 popad 0x00000023 push dword ptr [ebp+1246703Eh] 0x00000029 call 00007F7D81146DE9h 0x0000002e sub edx, dword ptr [ebp+1250DD0Bh] 0x00000034 pop edx 0x00000035 call 00007F7D81146DD9h 0x0000003a je 00007F7D81146DF2h 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB78C0 second address: DB78FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7D80D626C4h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007F7D80D626C1h 0x00000014 popad 0x00000015 pop edx 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB78FA second address: DB790D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7D81146DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB790D second address: DB7939 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F7D80D626BCh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F7D80D626C4h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB92EA second address: DB92EF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB8EB3 second address: DB8ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push ebx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F7D80D626C5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB8ED8 second address: DB8EDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBAF0F second address: DBAF1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F7D80D626B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBAF1E second address: DBAF22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBAF22 second address: DBAF38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F7D80D626B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBAF38 second address: DBAF3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBAF3E second address: DBAF46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBAF46 second address: DBAF4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90C47 second address: 4A90CC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D80D626BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test ecx, ecx 0x0000000b jmp 00007F7D80D626BEh 0x00000010 jns 00007F7D80D626F0h 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F7D80D626BEh 0x0000001d or cx, 6AD8h 0x00000022 jmp 00007F7D80D626BBh 0x00000027 popfd 0x00000028 mov ax, FD8Fh 0x0000002c popad 0x0000002d add eax, ecx 0x0000002f jmp 00007F7D80D626C2h 0x00000034 mov eax, dword ptr [eax+00000860h] 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F7D80D626C7h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90CC7 second address: 4A90CCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90CCD second address: 4A90CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90CD1 second address: 4A90CD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90CD5 second address: 4A90CE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test eax, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edx, ecx 0x0000000f mov ebx, eax 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90CE7 second address: 4A90D69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7D81146DE7h 0x00000009 jmp 00007F7D81146DE3h 0x0000000e popfd 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 je 00007F7DF22ACE1Ah 0x0000001a pushad 0x0000001b mov bh, ah 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F7D81146DDDh 0x00000024 sub al, 00000046h 0x00000027 jmp 00007F7D81146DE1h 0x0000002c popfd 0x0000002d mov dx, cx 0x00000030 popad 0x00000031 popad 0x00000032 test byte ptr [eax+04h], 00000005h 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F7D81146DE4h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90D69 second address: 4A90D6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90D6D second address: 4A90D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90D73 second address: 4A90D79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90D79 second address: 4A90D7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC722F second address: CC723D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnl 00007F7D80D626B6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC746A second address: CC7489 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7D81146DE4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7489 second address: CC7493 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7D80D626B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B115A6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D51B2B instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.1738065074.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759661432.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759526066.000000000058E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.1738065074.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759661432.00000000005F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW]
Source: file.exe, 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AF5BB0 LdrInitializeThunk,

0_2_00AF5BB0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: bathdoomgaz.stor
Source: file.exe	String found in binary or memory: spirittunek.stor
Source: file.exe	String found in binary or memory: dissapoiznw.stor
Source: file.exe	String found in binary or memory: studennotediw.stor
Source: file.exe	String found in binary or memory: mobbipenju.stor
Source: file.exe	String found in binary or memory: eaglepawnoy.stor

Source: file.exe, 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: GProgram Manager
Source: file.exe	Binary or memory string: Y!GProgram Manager

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	23 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	23 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.ZPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	unknown
eaglepawnoy.store	unknown	unknown	false	unknown
bathdoomgaz.store	unknown	unknown	false	unknown
spirittunek.store	unknown	unknown	false	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	false	unknown
mobbipenju.store	unknown	unknown	false	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
studennotediw.stor	true		unknown
spirittunek.stor	true		unknown
eaglepawnoy.stor	true		unknown
clearancek.site	true		unknown
mobbipenju.stor	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
licendfilteo.site	true		unknown
bathdoomgaz.stor	true		unknown
dissapoiznw.stor	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/my/wishlist/	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://player.vimeo.com	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bathdoomgaz.store:443/api	file.exe, 00000000.00000002.1759661432.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759749334.000000000062A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/market/	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/	file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759749334.000000000062A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759526066.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759526066.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://medal.tv	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759526066.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759526066.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://s.ytimg.com;	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759749334.000000000062A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900p	file.exe, 00000000.00000002.1759661432.00000000005E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738065074.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://store.steampowered.com/legal/	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steam.tv/	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://licendfilteo.site:443/api	file.exe, 00000000.00000002.1759661432.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/p	file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com:443/profiles/76561199724331900_	file.exe, 00000000.00000002.1759661432.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/g	file.exe, 00000000.00000002.1759661432.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/points/shop/	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759749334.000000000062A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759526066.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://dissapoiznw.store:443/apiW	file.exe, 00000000.00000002.1759661432.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mobbipenju.store:443/api	file.exe, 00000000.00000002.1759661432.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759749334.000000000062A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:27060	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759526066.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spirittunek.store:443/api	file.exe, 00000000.00000002.1759661432.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759749334.000000000062A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1759749334.000000000062A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/	file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	file.exe, 00000000.00000003.1738065074.000000000062A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/mobile	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	file.exe, 00000000.00000003.1737990607.000000000064A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	file.exe, 00000000.00000003.1737990607.0000000000642000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738030808.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	file.exe, 00000000.00000003.1738030808.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://clearancek.site:443/apibcryptPrimitives.dll	file.exe, 00000000.00000002.1759661432.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1738165903.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1526904
Start date and time:	2024-10-06 17:47:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@9/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://steamcomminutty.com/tradeoffer/new/?partner=917461351&token=ynekauF-3y	Get hash	malicious	Unknown	Browse	104.102.49.254
	https://sneamcomnnumnlty.com/jfh8893040282949023/here/put	Get hash	malicious	Unknown	Browse	104.102.49.254
	https://steamcommunrutty.com/gift/actlvation=Mor85Fhn6w4	Get hash	malicious	Unknown	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://steamcomminutty.com/tradeoffer/new/?partner=917461351&token=ynekauF-3y	Get hash	malicious	Unknown	Browse	88.221.169.65
	https://sneamcomnnumnlty.com/jfh8893040282949023/here/put	Get hash	malicious	Unknown	Browse	88.221.169.65
	https://steamcommunrutty.com/gift/actlvation=Mor85Fhn6w4	Get hash	malicious	Unknown	Browse	104.102.49.254
	http://www.ledger-secure03948.sssgva.com/	Get hash	malicious	Unknown	Browse	88.221.168.23

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948331654123043
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'890'816 bytes
MD5:	b6ef24e90b59608f2b6765e5f07ad8e3
SHA1:	b3b4539c0c6bf4027df6a9bac4a84afa51ca105c
SHA256:	5b8c002435003ad4e6a178b9aaef6e398d6491ff080857550deb71fbfefb3a9d
SHA512:	38345365e8d8b36d0d950418fae2286f773668d469c7d0120d1a75c7e561bae57f8723bb8cb9c83211f947cde8882746dd474ca1ed162ea7b3790876ddf4949c
SSDEEP:	49152:cgPoVNEbLLiSkhqq6jW1tVahNnEU+9NrgTgX:bP2E7iSSRWOa7EU+8kX
TLSH:	3295331A29E00490F67A90B6B76FD1012A43D755F43C48BDBE5DC06053BEBDADE06AF8
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................K...........@...........................K...../.....@.................................W...k..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8ba000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F7D813ADF6Ah
popcnt ebx, dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F7D813AFF65h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	c9e836a05e9d3857cb8d7c3f8ba80244	False	0.9996067966171617	data	7.9848772918639925	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x60000	0x2b4000	0x200	204e2388cea88e4e2f6ba49a1b1c8074	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
psmjilnq	0x314000	0x1a5000	0x1a4200	2f244127e92d02522a19d21ed2d2464f	False	0.993955830667956	data	7.954517052404453	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fwpdehgj	0x4b9000	0x1000	0x400	49cfcaf7587c3c35770c22adcaabeea8	False	0.794921875	data	6.181310009143769	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4ba000	0x3000	0x2200	cda0de28ea387ab487ba9fa1e3033a11	False	0.00666360294117647	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-06T17:48:03.535972+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	57909	1.1.1.1	53	UDP
2024-10-06T17:48:03.553253+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	59721	1.1.1.1	53	UDP
2024-10-06T17:48:03.564570+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	61232	1.1.1.1	53	UDP
2024-10-06T17:48:03.576767+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	55805	1.1.1.1	53	UDP
2024-10-06T17:48:03.675143+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	65336	1.1.1.1	53	UDP
2024-10-06T17:48:03.736103+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	53670	1.1.1.1	53	UDP
2024-10-06T17:48:03.754565+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	63037	1.1.1.1	53	UDP
2024-10-06T17:48:03.770399+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	53801	1.1.1.1	53	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 17:48:03.882864952 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 6, 2024 17:48:03.882945061 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 6, 2024 17:48:03.883121014 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 6, 2024 17:48:03.886451960 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 6, 2024 17:48:03.886483908 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 6, 2024 17:48:04.553503990 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 6, 2024 17:48:04.553596973 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 6, 2024 17:48:04.558176994 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 6, 2024 17:48:04.558199883 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 6, 2024 17:48:04.558689117 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 6, 2024 17:48:04.602910995 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 6, 2024 17:48:04.619117975 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 6, 2024 17:48:04.659413099 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 6, 2024 17:48:05.011706114 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 6, 2024 17:48:05.011761904 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 6, 2024 17:48:05.011770010 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 6, 2024 17:48:05.011790991 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 6, 2024 17:48:05.011809111 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 6, 2024 17:48:05.011812925 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 6, 2024 17:48:05.011826038 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 6, 2024 17:48:05.011851072 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 6, 2024 17:48:05.011899948 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 6, 2024 17:48:05.011908054 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 6, 2024 17:48:05.056045055 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 6, 2024 17:48:05.099826097 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 6, 2024 17:48:05.099836111 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 6, 2024 17:48:05.099885941 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 6, 2024 17:48:05.099901915 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 6, 2024 17:48:05.099925995 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 6, 2024 17:48:05.099948883 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 6, 2024 17:48:05.099972963 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 6, 2024 17:48:05.099998951 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 6, 2024 17:48:05.101838112 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 6, 2024 17:48:05.101865053 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 6, 2024 17:48:05.101888895 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 6, 2024 17:48:05.101900101 CEST	443	49730	104.102.49.254	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 17:48:03.535972118 CEST	57909	53	192.168.2.4	1.1.1.1
Oct 6, 2024 17:48:03.551909924 CEST	53	57909	1.1.1.1	192.168.2.4
Oct 6, 2024 17:48:03.553252935 CEST	59721	53	192.168.2.4	1.1.1.1
Oct 6, 2024 17:48:03.562668085 CEST	53	59721	1.1.1.1	192.168.2.4
Oct 6, 2024 17:48:03.564569950 CEST	61232	53	192.168.2.4	1.1.1.1
Oct 6, 2024 17:48:03.575032949 CEST	53	61232	1.1.1.1	192.168.2.4
Oct 6, 2024 17:48:03.576766968 CEST	55805	53	192.168.2.4	1.1.1.1
Oct 6, 2024 17:48:03.586042881 CEST	53	55805	1.1.1.1	192.168.2.4
Oct 6, 2024 17:48:03.675143003 CEST	65336	53	192.168.2.4	1.1.1.1
Oct 6, 2024 17:48:03.691663980 CEST	53	65336	1.1.1.1	192.168.2.4
Oct 6, 2024 17:48:03.736103058 CEST	53670	53	192.168.2.4	1.1.1.1
Oct 6, 2024 17:48:03.745963097 CEST	53	53670	1.1.1.1	192.168.2.4
Oct 6, 2024 17:48:03.754565001 CEST	63037	53	192.168.2.4	1.1.1.1
Oct 6, 2024 17:48:03.764866114 CEST	53	63037	1.1.1.1	192.168.2.4
Oct 6, 2024 17:48:03.770399094 CEST	53801	53	192.168.2.4	1.1.1.1
Oct 6, 2024 17:48:03.778842926 CEST	53	53801	1.1.1.1	192.168.2.4
Oct 6, 2024 17:48:03.870762110 CEST	60275	53	192.168.2.4	1.1.1.1
Oct 6, 2024 17:48:03.877944946 CEST	53	60275	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2024 17:48:03.535972118 CEST	192.168.2.4	1.1.1.1	0x6cb6	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:48:03.553252935 CEST	192.168.2.4	1.1.1.1	0x5d14	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:48:03.564569950 CEST	192.168.2.4	1.1.1.1	0x2d85	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:48:03.576766968 CEST	192.168.2.4	1.1.1.1	0x6ee4	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:48:03.675143003 CEST	192.168.2.4	1.1.1.1	0x7d78	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:48:03.736103058 CEST	192.168.2.4	1.1.1.1	0x7e28	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:48:03.754565001 CEST	192.168.2.4	1.1.1.1	0xd338	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:48:03.770399094 CEST	192.168.2.4	1.1.1.1	0xff05	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:48:03.870762110 CEST	192.168.2.4	1.1.1.1	0x897e	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 6, 2024 17:48:03.551909924 CEST	1.1.1.1	192.168.2.4	0x6cb6	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:48:03.562668085 CEST	1.1.1.1	192.168.2.4	0x5d14	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:48:03.575032949 CEST	1.1.1.1	192.168.2.4	0x2d85	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:48:03.586042881 CEST	1.1.1.1	192.168.2.4	0x6ee4	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:48:03.691663980 CEST	1.1.1.1	192.168.2.4	0x7d78	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:48:03.745963097 CEST	1.1.1.1	192.168.2.4	0x7e28	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:48:03.764866114 CEST	1.1.1.1	192.168.2.4	0xd338	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:48:03.778842926 CEST	1.1.1.1	192.168.2.4	0xff05	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 17:48:03.877944946 CEST	1.1.1.1	192.168.2.4	0x897e	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.102.49.254	443	6100	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-06 15:48:04 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-06 15:48:05 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sun, 06 Oct 2024 15:48:04 GMT Content-Length: 25489 Connection: close Set-Cookie: sessionid=55ee334b130c2eef734da2b0; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-06 15:48:05 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-06 15:48:05 UTC	10975	IN	Data Raw: 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 74 68 61 69 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 68 61 69 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e0 b9 84 e0 b8 97 e0 b8 a2 20 28 54 68 61 69 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 62 75 6c 67 61 72 69 61 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 62 75 6c 67 61 72 69 61 6e 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 Data Ascii: <a class="popup_menu_item tight" href="?l=thai" onclick="ChangeLanguage( 'thai' ); return false;"> (Thai)</a><a class="popup_menu_item tight" href="?l=bulgarian" onclick="ChangeLanguage( 'bulgarian' ); return fa

Target ID:	0
Start time:	11:48:00
Start date:	06/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xab0000
File size:	1'890'816 bytes
MD5 hash:	B6EF24E90B59608F2B6765E5F07AD8E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	61.1%
Total number of Nodes:	54
Total number of Limit Nodes:	6

Executed Functions

Function 00AF50FA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(19A41BB1,00000000,00000800), ref: 00AF5182

Strings

@^, xrefs: 00AF5120
<I$), xrefs: 00AF5198
<I$), xrefs: 00AF52E3

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: <I$)$<I$)$@^
API String ID: 1029625771-935358343
Opcode ID: 7c7656e3f331018a982c4c19f636aef3cb30bddf7d847cea31a75d52be77e3bf
Instruction ID: bf3d10d76f88242016ab6d7e92a0a642cfc61020da2f4b8d8f35af9cd4bf7990
Opcode Fuzzy Hash: 7c7656e3f331018a982c4c19f636aef3cb30bddf7d847cea31a75d52be77e3bf
Instruction Fuzzy Hash: 0521A1355083848FC300DFA8D88476ABBF4AB66300F69882CE2C5D7351DB35D915CB56

Function 00ABFCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

J|BJ, xrefs: 00AC000D
V, xrefs: 00ABFEDC
VY^_, xrefs: 00ABFDFF
t, xrefs: 00ABFCBE

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: 8ccb8c26e6e10cb752b773beaba747f246757a63169598663e8238e9368eaa78
Instruction ID: 3c17b32711bb8d670028ca770cfeea6a3a9d954287679c9354059d17d74568a8
Opcode Fuzzy Hash: 8ccb8c26e6e10cb752b773beaba747f246757a63169598663e8238e9368eaa78
Instruction Fuzzy Hash: 92D166B45083809FD310DF288990B6FFBE5AB92B44F19891CF4C98B252C336CD49DB92

Function 00ABD110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 00ABD2F0

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 3d6063ae4a02cc09a51cc5ea70b10e1eba7320a8643746d49426adfa1ebd340f
Instruction ID: 148eecfee1e5e0ce484503ec6b5e8c149943bcc70e7b29fb388d0580f27e708d
Opcode Fuzzy Hash: 3d6063ae4a02cc09a51cc5ea70b10e1eba7320a8643746d49426adfa1ebd340f
Instruction Fuzzy Hash: 7F41447040D380ABD701BB68D685A6EFBF9AF92744F048C1CE5C49B213E33AD8149B67

Function 00AF5700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00AF5784

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1288523c18d63ed32ca5ea9afceaf4eba39aa7510899660ffd1e34a9e40a9133
Instruction ID: 487cbe4662165b44e7749d1cd375aa61957960c27bcedacf17a3609ec5d7947a
Opcode Fuzzy Hash: 1288523c18d63ed32ca5ea9afceaf4eba39aa7510899660ffd1e34a9e40a9133
Instruction Fuzzy Hash: 6911A07191C640EBC701AF68E944A2BBBF9EF96710F058C28F6C49B211D736D810CB93

Function 00AF5BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00AF973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00AF5BDE

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00AF695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 00AF69C5

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 745e2f0b7f3f2ea5f337551100f8f13ec87e63d5ca154b2d990379ded88866a4
Instruction ID: 0212f84e1ba3b860c2ce4ceff140e3622d0d9d21b1f237d237cf01b4508d6660
Opcode Fuzzy Hash: 745e2f0b7f3f2ea5f337551100f8f13ec87e63d5ca154b2d990379ded88866a4
Instruction Fuzzy Hash: AD3185B15083059FD718EF68C8A063BB7F1EF94384F48981CF6C6972A1E7359904CB56

Function 00AC049B Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 943047d2846b42bd13834f3a8b2641ac3051f9936bc241b12d4a67fc4bda0c53
Instruction ID: ed57eea961501f6637e2408e7d42575a0606796c48d3d55a4f02e0f39d264b4e
Opcode Fuzzy Hash: 943047d2846b42bd13834f3a8b2641ac3051f9936bc241b12d4a67fc4bda0c53
Instruction Fuzzy Hash: 77917975200B00DFD724CF65E894B27B7F6FF89314B118A6DE9568BAA1DB30E816CB50

Function 00AC0228 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de48a8bd397f5bffa638d9b7eef7bf61badcac3e2bf4316799027029be120180
Instruction ID: b0636ae198bcfa89cf659dae393b2f57b6e5981b2b709bc95ef130d83bbbca93
Opcode Fuzzy Hash: de48a8bd397f5bffa638d9b7eef7bf61badcac3e2bf4316799027029be120180
Instruction Fuzzy Hash: 1B716874200700DFD724CFA1E894F26B7F6FF49315F11896DE9968BA62DB31A816CB50

Function 00AF99D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13bec87ae9a4f339f0179082a6a8f277447f98838fc58c17ea0251fae4e89744
Instruction ID: cd1de383b6d609c87d6b37138a4d2cc786a2c10ca7583c8a3d4117d8356d22a8
Opcode Fuzzy Hash: 13bec87ae9a4f339f0179082a6a8f277447f98838fc58c17ea0251fae4e89744
Instruction Fuzzy Hash: DA419D34608308ABD724AF95D990B3BB7A6EB85754F14882CF68A97251D331EC11DB62

Function 00AF63B8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4e4a45e1ef082620ee79571f91d23fa79bf4cb9124d727c521f256af2b701a90
Instruction ID: c4dceca436971177877e2eaaea5325b3bcc6ee0000517beed1d913ed643751f6
Opcode Fuzzy Hash: 4e4a45e1ef082620ee79571f91d23fa79bf4cb9124d727c521f256af2b701a90
Instruction Fuzzy Hash: C531D270649305BADA24EB44CE82F3BB7A5EB90B51F64850CF3815B2E1D770AC119B52

Function 00AF3220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00AF32A6

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 0213a8b2743d8b74fa445f7b9508f1aab4c63cdea94b3073fde53feb1e807b6b
Instruction ID: 9c769422ddc486027e35132dbd8ad433cce6eaa1d8092a6fd43812ea38172b31
Opcode Fuzzy Hash: 0213a8b2743d8b74fa445f7b9508f1aab4c63cdea94b3073fde53feb1e807b6b
Instruction Fuzzy Hash: 61016D3450D2409BC701EF58E889A2ABBE8EF6AB00F05481CF6C58B361D735DD60CB96

Function 00AF3202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00AF3208

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 83b90e01e54b5353b5ee5fa0012382b09607334d8d2691b0fe89812e907d0f90
Instruction ID: fa0b4ed87cd2caa80fe1318872e61e24430067d44ce2825d4e7e7adb4217dc1e
Opcode Fuzzy Hash: 83b90e01e54b5353b5ee5fa0012382b09607334d8d2691b0fe89812e907d0f90
Instruction Fuzzy Hash: 1FB012301400005FDA041B00EC0AF003510FB10605F800050B100050F1D5615C64C555

Non-executed Functions

Function 00ACDB6F Relevance: 32.0, Strings: 24, Instructions: 2006COMMON

Download Yara Rule

Strings

89>?, xrefs: 00ACE9F6
WP, xrefs: 00ACDCEF
tuJK, xrefs: 00ACE967
QNOL, xrefs: 00ACE775
`onm, xrefs: 00ACE733
T, xrefs: 00ACF157
tsrq, xrefs: 00ACE6FC
D, xrefs: 00ACE846
()./, xrefs: 00ACE9CA
|, xrefs: 00ACECB1
@ONM, xrefs: 00ACE6DB
xgfe, xrefs: 00ACE71D
mjkh, xrefs: 00ACE7D8
LKJI, xrefs: 00ACE6E6
dcba, xrefs: 00ACE728
<=:;, xrefs: 00ACE930
AR, xrefs: 00ACDD10
89&', xrefs: 00ACE93B
:WUE, xrefs: 00ACF6B7, 00ACF6C6
lkji, xrefs: 00ACE73E
`Y^_, xrefs: 00ACE99E
DCBA, xrefs: 00ACE887, 00ACE896
%*+(, xrefs: 00ACDE37, 00ACDE46
<=2, xrefs: 00ACEA01

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 2994545307-1418943773
Opcode ID: 5e450f924016e43bf4b52f201294f5fedc5312d3898291691f8352b4928c11a8
Instruction ID: a190b4ab6dfb8223301250a5dd89c87a08d5fcf41adc9ae2db3e668cf8a55693
Opcode Fuzzy Hash: 5e450f924016e43bf4b52f201294f5fedc5312d3898291691f8352b4928c11a8
Instruction Fuzzy Hash: A4F276B15093819FD770CF14C884BABBBE6BFD5304F15482DE5C98B292EB319984CB92

Function 00AE23E0 Relevance: 31.3, APIs: 4, Strings: 12, Instructions: 3298COMMON

Download Yara Rule

Strings

3<, xrefs: 00AE32D6
`tii, xrefs: 00AE2693
aenQ, xrefs: 00AE276A
Cx, xrefs: 00AE453D
:, xrefs: 00AE32DD
f@~!, xrefs: 00AE25FF
{l`~, xrefs: 00AE268C
%*+(, xrefs: 00AE40EF
mlc@, xrefs: 00AE275C
ggxz, xrefs: 00AE2685
|}&C, xrefs: 00AE2F21
fedc, xrefs: 00AE2782

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: %*+($3<$:$Cx$`tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~$|}&C
API String ID: 0-786070067
Opcode ID: 67a13919a29a3b3046df3e323b13e559818e61246d5f577d3c38768689a24596
Instruction ID: ad50eb08b292956f3cbc90e9eb4b600fe0f47ca110bea3d0ef31afb4d7fa2921
Opcode Fuzzy Hash: 67a13919a29a3b3046df3e323b13e559818e61246d5f577d3c38768689a24596
Instruction Fuzzy Hash: EB33CE70504B818FDB258F3AC594762BBF1BF16304F58899DE4DA8BB92C735E806CB61

Function 00AD9F62 Relevance: 21.7, Strings: 17, Instructions: 473COMMON

Download Yara Rule

Strings

sm, xrefs: 00ADA830
%e6g, xrefs: 00ADA152
(a*c, xrefs: 00ADA147
JG, xrefs: 00ADAA27
WQ, xrefs: 00ADA62B
kW, xrefs: 00ADA380
Gt, xrefs: 00AD9FF8
WH, xrefs: 00ADAA1C
S], xrefs: 00ADA636
/), xrefs: 00ADA66D
CG, xrefs: 00ADAA32
N[, xrefs: 00ADA375
]{, xrefs: 00ADA1E7, 00ADA1F3
hi, xrefs: 00ADAB9D
_Y, xrefs: 00ADA641
?m,o, xrefs: 00ADA13C
=], xrefs: 00ADA36A

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: f941cc96d86a3756533d2fcaa5e32ba620f4f855b91d26ffe3e6ea07ca300af6
Instruction ID: 95c0ab416c16d6906fee2291122f07be9c6dece0a52391a34ce5448eb5c78b95
Opcode Fuzzy Hash: f941cc96d86a3756533d2fcaa5e32ba620f4f855b91d26ffe3e6ea07ca300af6
Instruction Fuzzy Hash: 8552B6B404D3858AE274CF25D681B8EBAF1BB92740F608E1EE1ED9B255DB708045CF93

Function 00AD9510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

;IJK, xrefs: 00AD983E
G+X5, xrefs: 00AD9AF3
T#a-, xrefs: 00AD9AE3
pq, xrefs: 00AD99E0
X/R), xrefs: 00AD9AEB
8;, xrefs: 00AD9B13
?M0K, xrefs: 00AD9968
B7U1, xrefs: 00AD9AFB
2A"_, xrefs: 00AD9980
G'M!, xrefs: 00AD9ADB
,A&C, xrefs: 00AD982E
L3Y=, xrefs: 00AD9B03
z=Q?, xrefs: 00AD9826
!E4G, xrefs: 00AD9836
B?Q9, xrefs: 00AD9B0B
O+f), xrefs: 00AD9634, 00AD963D

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: 492ddfd3298817a3c132e0c23bed63caad0455af39dcffd52a8a90a8c9b4a503
Instruction ID: bbede99dd65ae5e3567acdb1043ae9464ae39bf56ade323bf6a4194c4b0819e5
Opcode Fuzzy Hash: 492ddfd3298817a3c132e0c23bed63caad0455af39dcffd52a8a90a8c9b4a503
Instruction Fuzzy Hash: E1F13EB0418380ABD310DF15D980A2BBBF4BB96B88F044D1DF4DA9B352D374D908DBA6

Function 00ADDD29 Relevance: 14.9, Strings: 11, Instructions: 1142COMMON

Download Yara Rule

Strings

<Y.[, xrefs: 00ADE27D
-M2O, xrefs: 00ADE25A
,Q?S, xrefs: 00ADE26F
%*+(, xrefs: 00ADE143
{E, xrefs: 00ADE323
n\+H, xrefs: 00ADDDC0
hX]N, xrefs: 00ADDDC7
)IgK, xrefs: 00ADE261
Y9N;, xrefs: 00ADE245
upH}, xrefs: 00ADDE8A, 00ADE798, 00ADDF4A
=]+_, xrefs: 00ADE276

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: %*+($)IgK$,Q?S$-M2O$<Y.[$=]+_$Y9N;$hX]N$n\+H$upH}${E
API String ID: 0-1557708024
Opcode ID: b527226310afbd2cee018b5096188528c3fdd9cdfa6c12646ea25e1c292b0b59
Instruction ID: f1ef15662b4177a915f2879be51512dd5158fab128213110aad6c25e3c438cc8
Opcode Fuzzy Hash: b527226310afbd2cee018b5096188528c3fdd9cdfa6c12646ea25e1c292b0b59
Instruction Fuzzy Hash: AF920471E00205CFDB18CF68D8917AEBBB2FF59310F298669E456AB391D735AD01CB90

Function 00C84F0F Relevance: 12.9, Strings: 9, Instructions: 1629COMMON

Download Yara Rule

Strings

M}U, xrefs: 00C8568E
Awwo, xrefs: 00C85554
sg[, xrefs: 00C854F1
3?, xrefs: 00C858D8
cc9, xrefs: 00C85B79
lD]w, xrefs: 00C85850
7Df, xrefs: 00C85442
vvd, xrefs: 00C85896
Faw, xrefs: 00C859B6

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: cc9$3?$7Df$Awwo$Faw$lD]w$sg[$M}U$vvd
API String ID: 0-2359081535
Opcode ID: 27382e6707da17cef1ee1a478d1eb727dc1ee5b584f39da0bc0de8d4c76afbd1
Instruction ID: b3b5faf86a92cc5c4fbe18ea73f0c7005f1a159dde621d654e7dc7cac148dc52
Opcode Fuzzy Hash: 27382e6707da17cef1ee1a478d1eb727dc1ee5b584f39da0bc0de8d4c76afbd1
Instruction Fuzzy Hash: CCB204F360C6049FE3046E2DEC8577ABBE9EF94320F1A493DE6C4C7744EA7598408696

Function 00C818FB Relevance: 11.7, Strings: 8, Instructions: 1677COMMON

Download Yara Rule

Strings

q=;, xrefs: 00C81ECF
={|, xrefs: 00C828D1
u~w_, xrefs: 00C8196C
t)], xrefs: 00C82068
u~w_, xrefs: 00C81961
So3, xrefs: 00C819AF
/|9", xrefs: 00C823D8
br_~, xrefs: 00C81B02

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: So3$/|9"$={|$br_~$t)]$u~w_$u~w_$q=;
API String ID: 0-3758211446
Opcode ID: 03c04c65e05a20687480bccc110b5c728af0bc32643d1f68a05e2d13e0f6c868
Instruction ID: 902e754f9862229727b6440812d318280ddbe321bc4b584138c465ea8d3b25fc
Opcode Fuzzy Hash: 03c04c65e05a20687480bccc110b5c728af0bc32643d1f68a05e2d13e0f6c868
Instruction Fuzzy Hash: 23B227F360C204AFE304AE29EC8567AF7E9EFD4720F16893DE6C4C7744EA7558058692

Function 00AD098B Relevance: 10.8, Strings: 8, Instructions: 836COMMON

Download Yara Rule

Strings

{, xrefs: 00AD1502
,#15, xrefs: 00AD0F94
%*+(, xrefs: 00AD0A77, 00AD0A86
qrqp, xrefs: 00AD1089
&> &, xrefs: 00AD0F89
cah`, xrefs: 00AD107E
9.5^, xrefs: 00AD0F9F
gce/, xrefs: 00AD1073

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: %*+($&> &$,#15$9.5^$cah`$gce/$qrqp${
API String ID: 0-4102007303
Opcode ID: 30b5443c8497ae1cd646f2bb07dedb5ae3151b6752f41516bff4f90e837c21ee
Instruction ID: 9920b1d377a82e73156b09d7f124a1224c9d6dd870367ffb1080b9f99b3256b8
Opcode Fuzzy Hash: 30b5443c8497ae1cd646f2bb07dedb5ae3151b6752f41516bff4f90e837c21ee
Instruction Fuzzy Hash: 5D6288B56083818BD730DF14D891BABBBE1FFA6314F04492EE49A8B742E7759940CB53

Function 00AB1000 Relevance: 10.5, Strings: 7, Instructions: 1785COMMON

Download Yara Rule

Strings

gfff, xrefs: 00AB2226
0123456789abcdefxp, xrefs: 00AB1587, 00AB15F8
@, xrefs: 00AB2C40
gfff, xrefs: 00AB2297
0123456789ABCDEFXP, xrefs: 00AB157D, 00AB15EB
-, xrefs: 00AB21ED
gfff, xrefs: 00AB22E1

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff
API String ID: 0-2517803157
Opcode ID: 715758396313028be5db10a8689b89587c33111111e626321ce3c76becf4061c
Instruction ID: efd36370ebf50ed58a6566d2abc710c6e69286a8cec2af2d12a1054e6ab156a1
Opcode Fuzzy Hash: 715758396313028be5db10a8689b89587c33111111e626321ce3c76becf4061c
Instruction Fuzzy Hash: 16D2F5726083418FD718CF29C4943AABBE6AFD5314F188A2DE499CB392D774DD45CB82

Function 00C75C84 Relevance: 9.1, Strings: 6, Instructions: 1622COMMON

Download Yara Rule

Strings

s7.1, xrefs: 00C76BEC
*7, xrefs: 00C7636A
,?uK, xrefs: 00C76620
*7, xrefs: 00C763C6
sNg, xrefs: 00C7608A
5~w, xrefs: 00C761F4

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: *7$*7$,?uK$s7.1$5~w$sNg
API String ID: 0-1906259556
Opcode ID: 92ef8135b59f5f2e4ca6d7706efd209d15ee1258138217d66e141f1c179b8b43
Instruction ID: 4b6d5f7abccb0aee67a2fc2f379d3ff0d3ca2776e7d916e8b00abe0911c6a51c
Opcode Fuzzy Hash: 92ef8135b59f5f2e4ca6d7706efd209d15ee1258138217d66e141f1c179b8b43
Instruction Fuzzy Hash: 33B24BF3A0C2049FE304AE2DEC8577ABBD9EF94720F1A453DEAC5C3744E97558018696

Function 00C791C7 Relevance: 9.1, Strings: 6, Instructions: 1568COMMON

Download Yara Rule

Strings

hJ}, xrefs: 00C79E34
{C~?, xrefs: 00C799FD
'm~, xrefs: 00C7A3CC
_>;, xrefs: 00C79B79
%w>, xrefs: 00C7A200
Te~n, xrefs: 00C795B5

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: _>;$%w>$'m~$Te~n$hJ}${C~?
API String ID: 0-2529549349
Opcode ID: 30ddccde2c5935e8a7c27b6a4d96d364811e4a3970a8358782cc22d5da6ae50d
Instruction ID: 7295b11acfa2a3a0221297fbf0cd800b612ebd7f1d167a1f41971082d292d6c3
Opcode Fuzzy Hash: 30ddccde2c5935e8a7c27b6a4d96d364811e4a3970a8358782cc22d5da6ae50d
Instruction Fuzzy Hash: ABB2E3F360C2049FE304AE2DEC8567ABBE9EF94720F16493DEAC587744EA3558048797

Function 00C776AA Relevance: 7.9, Strings: 5, Instructions: 1656COMMON

Download Yara Rule

Strings

_Pw], xrefs: 00C7781E
Kh?, xrefs: 00C784F3
0OW, xrefs: 00C77C38
)A~o, xrefs: 00C77D18
`W~, xrefs: 00C7845A

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: )A~o$Kh?$_Pw]$`W~$0OW
API String ID: 0-4224653652
Opcode ID: d806edff0fefcabda10cdd0974c0e2d5f130d661f3b2d6d4cebc8bed7c05c467
Instruction ID: 0c4069103c8c5db809e1581d8e108898f9301284aaf66e437fe3de9ffa482523
Opcode Fuzzy Hash: d806edff0fefcabda10cdd0974c0e2d5f130d661f3b2d6d4cebc8bed7c05c467
Instruction Fuzzy Hash: ECB209F3A0C2049FE3046E2DEC8577ABBE9EB94720F1A453DEAC4C7744E93598058697

Function 00AB12F7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

i, xrefs: 00AB28EA
0, xrefs: 00AB243E
0, xrefs: 00AB1E88
0, xrefs: 00AB1DC1
@, xrefs: 00AB3531

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 495b7cc99ca772fe1133ceac3bff9644dc01a179b0b74f5f8a0024d08b52aafa
Instruction ID: f09dce3d410e0116e11553550771bb90b25fedc4f9193fc110a4e4b850ea1f87
Opcode Fuzzy Hash: 495b7cc99ca772fe1133ceac3bff9644dc01a179b0b74f5f8a0024d08b52aafa
Instruction Fuzzy Hash: 9462D27160C3818FD719CF28C4907AABBE5AFD5344F188E2EE8D987292D774D949CB42

Function 00AB164F Relevance: 6.7, Strings: 5, Instructions: 472COMMON

Download Yara Rule

Strings

0123456789abcdefxp, xrefs: 00AB1659
gfff, xrefs: 00AB1F3C
gfff, xrefs: 00AB1F57
+, xrefs: 00AB1573
0123456789ABCDEFXP, xrefs: 00AB164F

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-1123320326
Opcode ID: 6110bca31811bca3995713c5c7afa296753e3e23e669c4b02874ad60e9927164
Instruction ID: 54ba21873197f7732167bb4688de9a1252ae679232d139d2b6c36f550053e412
Opcode Fuzzy Hash: 6110bca31811bca3995713c5c7afa296753e3e23e669c4b02874ad60e9927164
Instruction Fuzzy Hash: 7FF1903160C3818FC719CF29C4943AAFBE6ABD9304F188A6EE4D987356D734D945CB92

Function 00C86935 Relevance: 6.7, Strings: 4, Instructions: 1672COMMON

Download Yara Rule

Strings

TQiw, xrefs: 00C87787
m~~, xrefs: 00C86D73
e^ay, xrefs: 00C872F6
gB_, xrefs: 00C87C53

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: TQiw$e^ay$gB_$m~~
API String ID: 0-4215023130
Opcode ID: f3f8f95ccb5b8ec616058fc9560ef89f149dcf4f964af9405cf9d14b312526fd
Instruction ID: e4d1219ce3c718faf3fca6c270d1b76a23de19131c2d6d21eb609f77bbd064d5
Opcode Fuzzy Hash: f3f8f95ccb5b8ec616058fc9560ef89f149dcf4f964af9405cf9d14b312526fd
Instruction Fuzzy Hash: EAB2F6F3A082049FD3046E2DEC8567AFBEAEF94720F1A493DE6C5C3744EA3558058697

Function 00AB13A3 Relevance: 6.6, Strings: 5, Instructions: 390COMMON

Download Yara Rule

Strings

0123456789abcdefxp, xrefs: 00AB13AD
gfff, xrefs: 00AB1F3C
gfff, xrefs: 00AB1F57
-, xrefs: 00AB1F23
0123456789ABCDEFXP, xrefs: 00AB13A3

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: c9ba8d851d6ac95f33b53d5245593974ffbe1bf5bddb8a2f8b069ff78cf01b40
Instruction ID: fefe4296ab770902f18c11272893774a2bca28de527d9f7e36a2e2cf8c0e1c0a
Opcode Fuzzy Hash: c9ba8d851d6ac95f33b53d5245593974ffbe1bf5bddb8a2f8b069ff78cf01b40
Instruction Fuzzy Hash: E9D19E716087818FC719CF29C4942AAFFE2AFD9304F08CA6EE4D987356D634D949CB52

Function 00C74103 Relevance: 6.6, Strings: 4, Instructions: 1634COMMON

Download Yara Rule

Strings

.9N, xrefs: 00C746F0
o6P, xrefs: 00C751C0
4S}, xrefs: 00C745C1
`^Sg, xrefs: 00C74BC8

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: .9N$4S}$`^Sg$o6P
API String ID: 0-3664385439
Opcode ID: b4f042c8d19b7b25191cc1bfbb226aa6157196db588786133f52ccfffd4179d0
Instruction ID: 10d48046b5ea4544ce999b396ed044115218999bdc7820bd3e0c3d3e04c052b1
Opcode Fuzzy Hash: b4f042c8d19b7b25191cc1bfbb226aa6157196db588786133f52ccfffd4179d0
Instruction Fuzzy Hash: 33B217F360C2009FE7046E2DEC8567ABBE9EF94320F164A3DE6C5C7744EA3558058796

Function 00C8BA24 Relevance: 6.6, Strings: 4, Instructions: 1605COMMON

Download Yara Rule

Strings

fD;, xrefs: 00C8BF74
Z ~|, xrefs: 00C8C666
Z ~|, xrefs: 00C8C69E
Kyn, xrefs: 00C8C782

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: Kyn$Z ~|$Z ~|$fD;
API String ID: 0-4283070750
Opcode ID: a74a226c51d5dec6f434a1f00e955416aed04e86bf46a6be51fcd1899866d9d8
Instruction ID: 7755b3dbdd76e748cf8a11a006730988a046949f6ef720150a0cb282d013778c
Opcode Fuzzy Hash: a74a226c51d5dec6f434a1f00e955416aed04e86bf46a6be51fcd1899866d9d8
Instruction Fuzzy Hash: 33B207F360C2009FE304AE2DEC9567ABBE5EF94320F16463DEAC5C7744EA3598058697

Function 00C88446 Relevance: 6.6, Strings: 4, Instructions: 1595COMMON

Download Yara Rule

Strings

zo+, xrefs: 00C895AD
D3x~, xrefs: 00C88A60
2z, xrefs: 00C89744
gCw~, xrefs: 00C88F65

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: 2z$D3x~$gCw~$zo+
API String ID: 0-1476865096
Opcode ID: ca945aa9b72ddfb237df5932b14bd4dfa8e3c8062973dc3d326b2468037d21bd
Instruction ID: 8f510f387e630662fed4aa6d34b21b068af1d17ab9822563a0aa34f255624bb7
Opcode Fuzzy Hash: ca945aa9b72ddfb237df5932b14bd4dfa8e3c8062973dc3d326b2468037d21bd
Instruction Fuzzy Hash: A5B2E2F3A0C2049FE3046E2DEC8567ABBE9EF94720F1A493DE6C4C3744EA7558058796

Function 00ADFD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

uvw, xrefs: 00ADFE95
:, xrefs: 00AE0087
NA_I, xrefs: 00AE036D
m1s3, xrefs: 00ADFEC3, 00ADFECB

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: 66a2ffe2e5ff1dec06527b733f8f821f94ab3c5b1025f517aa0280a19195908f
Instruction ID: 2d16f6cc86bfc55c3ba710a7a4d74be79c13c87c711992d7ab66c14b659ec3b2
Opcode Fuzzy Hash: 66a2ffe2e5ff1dec06527b733f8f821f94ab3c5b1025f517aa0280a19195908f
Instruction Fuzzy Hash: F432B8B0508381DFD314DF2AD880A2BBBE5AB9A340F148E2CF5D58B2A2D775D945CF52

Function 00AC3BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AC3EC4
ss, xrefs: 00AC3C79
;z, xrefs: 00AC3C87
p, xrefs: 00AC3C80

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: 9d3d6f25c32477619799b5aeafefd17f835135a70e84dfb25785ac72fac17ae5
Instruction ID: 0f0c5ea6ffba23c9b13c6efdca5eb04c9cc064c55b3dbfada174cb643eb618af
Opcode Fuzzy Hash: 9d3d6f25c32477619799b5aeafefd17f835135a70e84dfb25785ac72fac17ae5
Instruction Fuzzy Hash: 66025CB4810B00DFD760DF25D986B56BFF4FB05300F50895DE89A8B656E731A815CBA2

Function 00AD2260 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

lc, xrefs: 00AD2507
a|, xrefs: 00AD2317
hu, xrefs: 00AD232F
sj, xrefs: 00AD2327

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: 587a0bc7b6e3e3aa17d3ed5051177011019a322443fbfe0c1c4f0bee66ee690d
Instruction ID: 4a9b3aa139057084d1d717f85e58eca359189a1f2b975ce975ddff17578fac2d
Opcode Fuzzy Hash: 587a0bc7b6e3e3aa17d3ed5051177011019a322443fbfe0c1c4f0bee66ee690d
Instruction Fuzzy Hash: 6CA168B44083418BC720DF18C891B2AB7F0FFA5754F588A0DE8DA9B391E339D945CB96

Function 00ADD7AF Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

#', xrefs: 00ADD9EA
T>, xrefs: 00ADD984
CV, xrefs: 00ADD98B
KV, xrefs: 00ADD97D

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: 5e0c2d9a7421d46234da014baf5bbb8d1ec6b33e41aaca472c1d4860dc0d7a3c
Instruction ID: 176ba31c25c274fb0b67c7049a018ad4ae41c72483bcfe4540583c0f2ef9b4ce
Opcode Fuzzy Hash: 5e0c2d9a7421d46234da014baf5bbb8d1ec6b33e41aaca472c1d4860dc0d7a3c
Instruction Fuzzy Hash: E38155B48017459BCB20DFA6D28556EBFB1FF12300F60460DE486ABB55C331AA55CFE2

Function 00ADAC91 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

lk, xrefs: 00ADACBC
(g6e, xrefs: 00ADACA1
4c2a, xrefs: 00ADACA9
,{*y, xrefs: 00ADAD07, 00ADAD13

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: 6de02a52f926160a428d4c8c613299c8e23ff20640b2d7b97024f748deec13ff
Instruction ID: 061bebdc0d2b91406fc9c31624ce3284a0e8f549151e3d1da8324e59d86b8b46
Opcode Fuzzy Hash: 6de02a52f926160a428d4c8c613299c8e23ff20640b2d7b97024f748deec13ff
Instruction Fuzzy Hash: 984183B4408382CBD7209F24D900BABB7F4FF96305F54995EE6C997260EB32D944CB96

Function 00C807C4 Relevance: 4.6, Strings: 3, Instructions: 800COMMON

Download Yara Rule

Strings

&hvy, xrefs: 00C80FCD
FLWo, xrefs: 00C80D08
OS=, xrefs: 00C80C04

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: &hvy$FLWo$OS=
API String ID: 0-2811044283
Opcode ID: 3eea2b4642441bcab6ac849976de21776ab76737d55d8cdc579395e3be954c6a
Instruction ID: 707add16cdfb07fa3e6f8637448a823dcd36cd9ffb9fb837b04d2e5185baffc0
Opcode Fuzzy Hash: 3eea2b4642441bcab6ac849976de21776ab76737d55d8cdc579395e3be954c6a
Instruction Fuzzy Hash: 6242D6F390C2009FE704AF28EC8577ABBE9EF94720F16892DE6C587344E63558158B97

Function 00ADC470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00ADC8C3, 00ADC8CB
~/i!, xrefs: 00ADC537
%*+(, xrefs: 00ADC9E4, 00ADC9ED

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: 2de0d193f682e9c8bcf919986cd7bc9c0daa09561dabd0c094550150c0c8505c
Instruction ID: e57b0d06dcc2cf0420fcd12422544e9359e2e7362347f29006cca1c93347c5e3
Opcode Fuzzy Hash: 2de0d193f682e9c8bcf919986cd7bc9c0daa09561dabd0c094550150c0c8505c
Instruction Fuzzy Hash: 55E195B5518345DFE3249F68D881B2BBBF5FB95350F88882DF68987251DB32D810CB92

Function 00AF4040 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AF40A4, 00AF40AD
f, xrefs: 00AF420C

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: 706467c4a074231f2c26e7c9ac9a297101fd54ccf8c3494c38792a1823bc94dc
Instruction ID: f5ae98dca8e781e6db7aa81c4d4533025a52a0db2836517313a1937d809a97b4
Opcode Fuzzy Hash: 706467c4a074231f2c26e7c9ac9a297101fd54ccf8c3494c38792a1823bc94dc
Instruction Fuzzy Hash: 06129A716083459FC714CF98C880B2FBBE6FB89314F188A2CF6959B291D735E945CB92

Function 00AEF620 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

hi, xrefs: 00AEF6E6
dg, xrefs: 00AEF7F5

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: dg$hi
API String ID: 0-2859417413
Opcode ID: 383b2f8e7409d24ae1219d058700ba98a02fc89a2e7e91e4eb6adb6111cd957f
Instruction ID: bcabcb59386d699837e1a1dabd5ee662ecbd0491858627ed49e40ebf1d486e59
Opcode Fuzzy Hash: 383b2f8e7409d24ae1219d058700ba98a02fc89a2e7e91e4eb6adb6111cd957f
Instruction Fuzzy Hash: F6F19571618342EFE704CF25D895B6ABBF6FB96384F14892CF1858B2A1CB34D945CB12

Function 00AB35B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

Inf, xrefs: 00AB3607
NaN, xrefs: 00AB360E

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: 389fe2d4ec70a00fa37fa5a3e7adbdc339dcff65c5ecb60fb83db992db0a7274
Instruction ID: 270669b65cbbf5e8f4c8a45e947c2a35566f82e9967f0d3e90b85032359772a5
Opcode Fuzzy Hash: 389fe2d4ec70a00fa37fa5a3e7adbdc339dcff65c5ecb60fb83db992db0a7274
Instruction Fuzzy Hash: 5CD1F672A083119BCB04CF69C88065FBBE5EFC8750F248A2DF99997391E771DD058B82

Function 00BA92FE Relevance: 2.7, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

fTW, xrefs: 00BA946F
V2, xrefs: 00BA93D4

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: V2$fTW
API String ID: 0-1106329597
Opcode ID: 52c2fe51aea8ee4602f502be38cd13b9a09bbf847a8d3c85f7277b6ee45d536e
Instruction ID: 55734fa03cf692b68d44c3e51dded328a8fa1218301b8ba6586e6341e010210c
Opcode Fuzzy Hash: 52c2fe51aea8ee4602f502be38cd13b9a09bbf847a8d3c85f7277b6ee45d536e
Instruction Fuzzy Hash: 36610BF3A183109BE3086E28EC857BAF7D5DB94320F1B063DDBC493784E9795801868A

Function 00ACFFDF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BaBc, xrefs: 00AD0197
Ye[g, xrefs: 00AD00F6

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: 8771aae4fd73b08e5a4f978c2777728f589040e5901f1f8b35836c4e844c4179
Instruction ID: 84ca0df6ac24c96dc09c645e52777542727728149fd32579eca38f837b8df6a2
Opcode Fuzzy Hash: 8771aae4fd73b08e5a4f978c2777728f589040e5901f1f8b35836c4e844c4179
Instruction Fuzzy Hash: F651A9B16083819BD731CF18C881BABB7E4FF96360F09891EE49A8B751E3749940CB57

Function 00AB5160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 00AB54C8

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: b77219796857ca1e3f09e6b05ffd5e9bc4114ba37d31f8a636d9aaaaaebd9da8
Instruction ID: 3195e82e35a01925e854571427504c57f5849e4f1aca4adbc1aa9fc4ef3b4d80
Opcode Fuzzy Hash: b77219796857ca1e3f09e6b05ffd5e9bc4114ba37d31f8a636d9aaaaaebd9da8
Instruction Fuzzy Hash: AC22C2B2E08B428BE7258F38D5503A6BBEAAFA1304F1D896DD8594B343EB71DC45C741

Function 00AE12D0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 00AE15D1

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: fe38b9619c63bf62487cd7c53f6ce8b044aa56e8d5c1159d8b6e5b843951091b
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: 54F12A71A083A14FC724CF26C450A6BBBE6AFC5354F1CC96DE89A8B382D634DD45C791

Function 00ADAE57 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00ADB2D3, 00ADB2DB

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: f4b15e54a3cf19d3bd3f1c8d543ed1e2833b0e068ee6a3b031880dd373e6f793
Instruction ID: 598dd20f159c0f3e8cb763432638fab40ea5823dd5c49ed617df1dc5e38d9bc2
Opcode Fuzzy Hash: f4b15e54a3cf19d3bd3f1c8d543ed1e2833b0e068ee6a3b031880dd373e6f793
Instruction Fuzzy Hash: A3E1A871518306CBC724DF29C89056EB7F2FFA8781F55891DE4C687320E730A959DBA2

Function 00AC6EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AC6EF3

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 5e12059f7b14fd8658a830a08752d3feff6c953e9fc8a93e0f6f968119793c8a
Instruction ID: 501a76091c9a38fe49875ca4c292b7124c7a3e3f27d2a051e561c5f9a6fdaaa8
Opcode Fuzzy Hash: 5e12059f7b14fd8658a830a08752d3feff6c953e9fc8a93e0f6f968119793c8a
Instruction Fuzzy Hash: 94F1A0B5600B01CFC725DF68D981A26B3F6FF48314B158A2DE59787692EB30F816CB41

Function 00AD7E60 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AD8263, 00AD826B

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 339677c352bf0aa1f336dc410cf482253ad00938d1a851bdf0ebd398bfe3edfe
Instruction ID: 425c7dd1c2a78f0390aade43273bc38e82e76d6579e9fb52b2c530e111949d25
Opcode Fuzzy Hash: 339677c352bf0aa1f336dc410cf482253ad00938d1a851bdf0ebd398bfe3edfe
Instruction Fuzzy Hash: 4AC1BE71508200ABD720EB14C882A6FB7F5EF95754F48891DF8C69B352E738ED05CBA2

Function 00AD8D62 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AD9233, 00AD923B

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 4744e40363618d33e034801ffe33f149a90d576e5d994834ee602e54536453a9
Instruction ID: f179574cf9d6e9e8c259dc88604a3e50944b5bbe24349fec64cdede642ab0865
Opcode Fuzzy Hash: 4744e40363618d33e034801ffe33f149a90d576e5d994834ee602e54536453a9
Instruction Fuzzy Hash: C2D1AD70628302DFD704EF68D890A6AB7E5FF99304F49497DE88687361DB34E950CB61

Function 00AF7FC0 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 00AF8167

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: b5d23809b575144f5816b55ab224e768f0cd77534ca91893e01d3e47c5959003
Instruction ID: 61f85d2b87aca99800e26d010511c8da2ad93a832a8529687b6e56c137fa0071
Opcode Fuzzy Hash: b5d23809b575144f5816b55ab224e768f0cd77534ca91893e01d3e47c5959003
Instruction Fuzzy Hash: 01D1F4329082694FC726CE58D89072FB6E1EB85758F15862CFAB5AB390CB75DC06C7C1

Function 00ADCCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00ADCDC3, 00ADCDCB

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: 33d47635a4b4050be162fe792248a8890462557e03de2932d13ab85a4d3d9f95
Instruction ID: 4879d5930b87a9befd8cbc710e1e975f0e3db270bb504a267c6450a3a254e533
Opcode Fuzzy Hash: 33d47635a4b4050be162fe792248a8890462557e03de2932d13ab85a4d3d9f95
Instruction Fuzzy Hash: 0BB111B06083069BD714DF18D880B2BBBF2EF95360F54482EE5C68B352E735E855CB92

Function 00AEFC20 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AEFCA4, 00AEFCAD

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 606779c01804946b66f0c2f6974f322e1de4c8b89ba1f2a0a3b93af54ed63a13
Instruction ID: db1aed5ad79dc0fae30fd1c842a55a0d1a6a48965ab68e5dffaa456cf339c7a3
Opcode Fuzzy Hash: 606779c01804946b66f0c2f6974f322e1de4c8b89ba1f2a0a3b93af54ed63a13
Instruction Fuzzy Hash: F681DB71508345AFD710DF6ADD84B2BBBE5FB99745F14882CF28587291EB30E814CBA2

Function 00ACD457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00ACD663, 00ACD66B

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: db3b99a3d6b976b979ddf1672493fcaba40f7da817b15b13d2c527e1bc8d0fe5
Instruction ID: bcac58561df619f3354b0c0ec28d219aee0e7d66b4ab646deb851545b42c991b
Opcode Fuzzy Hash: db3b99a3d6b976b979ddf1672493fcaba40f7da817b15b13d2c527e1bc8d0fe5
Instruction Fuzzy Hash: 1B61CE71918208DBD710AF58DC82F3AB3B5FFA4354F09092DF9869B252E775E910CB92

Function 00AF4A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AF4C33, 00AF4C3B

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: f036be72f5baac086c477bcfcbf037f09a52b4b2d9738d021ca5402b9d27e718
Instruction ID: 65ccb04255a4c7d85ed5b4347459bfd7a9588e4adfb67bcef1930c9aec471794
Opcode Fuzzy Hash: f036be72f5baac086c477bcfcbf037f09a52b4b2d9738d021ca5402b9d27e718
Instruction Fuzzy Hash: B761CF716083499BD721DFA9C880B3BBBE6EB98314F18891CF6C587292D771EC51CB52

Function 00ABE1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 00ABE333

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: 773443de2e92d40225e0dd0d53366735c915d3cdff92346b5697e46ff17cc38a
Instruction ID: 8db05badd5faaab5a4dea2a9c652bb7d73e568017af1b5234e2109d62835a5a5
Opcode Fuzzy Hash: 773443de2e92d40225e0dd0d53366735c915d3cdff92346b5697e46ff17cc38a
Instruction Fuzzy Hash: 89513433A196D04BD328DA7D5C552EA6EDB0FA2334B3DC369E9F1CB3E2D51588019390

Function 00AF3920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AF39E3, 00AF39EB

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: d9ce40bb2f470dd33c9bb9acae6786886be98c5e0fb2b796c4213ef8b4a932a8
Instruction ID: 9e8329991e672888ad9ba1bb4fc9aeb8ddd462b4d410d486928d9a00aff284d8
Opcode Fuzzy Hash: d9ce40bb2f470dd33c9bb9acae6786886be98c5e0fb2b796c4213ef8b4a932a8
Instruction Fuzzy Hash: CB51B2325092049BCF24EF96D990A3EBBE5EF85784F14881CF6C587251D772DD10DB62

Function 00D515F5 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

[wur, xrefs: 00D51731

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: [wur
API String ID: 0-2159391945
Opcode ID: 44f6f4f75cf2d382fba243ed70bcf6ecd505b8ed0f3b99f1042e5b36b89e02e6
Instruction ID: fe0af1a539f143f8856026b091826d45e3dabb998db7a226c2de144c8d27b648
Opcode Fuzzy Hash: 44f6f4f75cf2d382fba243ed70bcf6ecd505b8ed0f3b99f1042e5b36b89e02e6
Instruction Fuzzy Hash: 71417DFB80C250DFDB006A28DC80B7ABBE59B95361F3A063DDED557240E6328C09D697

Function 00AC1BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 00AC1C3E

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: 69471acf483a1780c2f2cc01560609e34d512ab876e79c0b55ce8b6146cc77f4
Instruction ID: 6bc04a9e7943217f94d34421f9cf8403afce1112b3c8d02a835ca33d712376b2
Opcode Fuzzy Hash: 69471acf483a1780c2f2cc01560609e34d512ab876e79c0b55ce8b6146cc77f4
Instruction Fuzzy Hash: E84141B410C3809BC7149F65C894A2FBBF0BF96314F04991CF5D69B291D736C915CB56

Function 00AEFF70 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AF0033, 00AF003B

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: f1c79a8204496631bcbe8ce5cec079ba12c6ad700c548c24b8049222fab7e470
Instruction ID: 0c2f1cd6805d08ecc9e12c5c060c908bf054e44f604e49c21c132f7905e68ae4
Opcode Fuzzy Hash: f1c79a8204496631bcbe8ce5cec079ba12c6ad700c548c24b8049222fab7e470
Instruction Fuzzy Hash: 2231D2B1908309ABD710EB94DC81F3BB7E9EB85744F544828FA85D7253EA31DC14CBA2

Function 00ADE40C Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

72?1, xrefs: 00ADE6A2

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 8d48a381224f4e4282f6218fca78a33df647f06925f44aed2a1d90709e9dcf1e
Instruction ID: 15a820c86a359cb26db37a8f62d3ca4b5fec3f11b4a8eb1b30523d5a22efb802
Opcode Fuzzy Hash: 8d48a381224f4e4282f6218fca78a33df647f06925f44aed2a1d90709e9dcf1e
Instruction Fuzzy Hash: 2631E4B5E00244CFCB20DF99E9809AFB7B5FB5A745F14082DE446AB301D731AD05CBA2

Function 00AC6F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AC703B

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 4aa0aa895f51df4cbd0ed41d3988af5635cafd38cc7c49fae4f355ee73df0e6b
Instruction ID: d1a1a1e5cbcef72b5a8cea4e1a6f19effb1b531f589dc5b29aadd29b913782db
Opcode Fuzzy Hash: 4aa0aa895f51df4cbd0ed41d3988af5635cafd38cc7c49fae4f355ee73df0e6b
Instruction Fuzzy Hash: 80412375614B049BD7358B65C995F2BBBF2FB09701F15881CE5869BAA1E732E8008F50

Function 00ADE66A Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

72?1, xrefs: 00ADE6A2

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 5defeb1636b39efee1817fdb87fb4081e12c8115026cb23ce4cac243ac5732cd
Instruction ID: e6399747cffd0c65be5c4a4469e7c626cad5c701953ec2c3adfcf4c131c5b80e
Opcode Fuzzy Hash: 5defeb1636b39efee1817fdb87fb4081e12c8115026cb23ce4cac243ac5732cd
Instruction Fuzzy Hash: 7121B0B1A00244CFC720EF99D9909AFBBB5FB1A745F14081DE446AB341C735AD01CBA2

Function 00AF9CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00AF9D30

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: ac93bb20e7775a582ae6b78eee5a7e79f9ed89a74a827ca6437d06c2f87274e5
Instruction ID: d74199b3829ebd89622c23887503c5dc4544f12fafe53cd1b13f728cd4972cc3
Opcode Fuzzy Hash: ac93bb20e7775a582ae6b78eee5a7e79f9ed89a74a827ca6437d06c2f87274e5
Instruction Fuzzy Hash: 903158709093089BD724EF55D880A2BFBF9EF9A354F24892CF6C897251D335D904CBA6

Function 00AC4E2A Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ec582c67bb469d889a8e6394a3b5aa9ce5c6d3e221aa14255ec68ec5f9a483
Instruction ID: 25ef5c3c54182773fea8b731b24a9557a3862ba8d5c43e822814a96a09b08505
Opcode Fuzzy Hash: e0ec582c67bb469d889a8e6394a3b5aa9ce5c6d3e221aa14255ec68ec5f9a483
Instruction Fuzzy Hash: C16258B4900B408FD735CF29D990B27B7F6AF49704F59892CE49A8BA52E774F844CB90

Function 00ABBEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction ID: 30cee625740c69cdda85844779877bee71fd2ef8e0801200cc0c67e325fb316e
Opcode Fuzzy Hash: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction Fuzzy Hash: E9522931A087118BC7259F1CD4506FAF3E5FFC5329F298A2DD9C697282E734A851CB86

Function 00AF8652 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b668f7453bb42a1ca134ffb1b86a42f8ac0fafa0c01bd261ac98ffa1398920e
Instruction ID: c45978cd001ce9f09a4274dc8ea94e2ee712b948d21728eb3fd4b4e79e846982
Opcode Fuzzy Hash: 1b668f7453bb42a1ca134ffb1b86a42f8ac0fafa0c01bd261ac98ffa1398920e
Instruction Fuzzy Hash: D622DE75608345CFC704EF68E89062ABBF1FF9A315F09896DE68987361DB35D850CB42

Function 00AF86F0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a5163cf2a5ffa5c428825dc6ba7d6987456cc485104c8b3db48a49a3474b793
Instruction ID: efd97a42cc544c7e001b509d82f6785538ec00dfbbdc20bf85424b5def60f650
Opcode Fuzzy Hash: 3a5163cf2a5ffa5c428825dc6ba7d6987456cc485104c8b3db48a49a3474b793
Instruction Fuzzy Hash: 2A22BC75608344DFC704EF68E89062ABBF1FF9A305F09896DE68987361DB35D850CB82

Function 00ABB3A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36cdceda8f7b2ce6fa902219e8af4ff5246d7f9ef2dad9e0ed6fb7e461763a89
Instruction ID: 09c796963248e4c7a28f97acdfef7d406258cf142eb3615ba43fc73068d83e82
Opcode Fuzzy Hash: 36cdceda8f7b2ce6fa902219e8af4ff5246d7f9ef2dad9e0ed6fb7e461763a89
Instruction Fuzzy Hash: E652D470918B888FE735CB24C4947E7BBEAAF91314F144D2DC5E606B83C7B9A885C761

Function 00AB71F0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ab5349e743e2cc0d7555c658a0ba9c29aa32df1725e2d60024eb36396d9a4a7
Instruction ID: f3c96a3ea9af75ab023042d4db66cd26a2755b55db02729f6371abe6e47b1e0a
Opcode Fuzzy Hash: 0ab5349e743e2cc0d7555c658a0ba9c29aa32df1725e2d60024eb36396d9a4a7
Instruction Fuzzy Hash: 25527C3150C3458BCB15CF29C0906EEBBE5BFC8314F198A6DE89A5B252D7B4D989CB81

Function 00AB8FD0 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e38751f04e0c269ecc54ed33eef6eaf67930044ccab6515533248e8be748fcae
Instruction ID: 700e393444901474f8a17c8dcf2106902be6fd6042f3afeb73c8c0f0413fc373
Opcode Fuzzy Hash: e38751f04e0c269ecc54ed33eef6eaf67930044ccab6515533248e8be748fcae
Instruction Fuzzy Hash: 4A428675608301DFD708CF68D8547AABBE1BF88315F09896CE5858B3A2D336D986CF42

Function 00AB7BF0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e60e5433b7bc338c1cac50a7b651fda4150ca5453f41c47ef594bc0199803a74
Instruction ID: 211d369546f9c1c4b3dfcb77b30cb23e7958950b4d862590e40d0f3011ba2692
Opcode Fuzzy Hash: e60e5433b7bc338c1cac50a7b651fda4150ca5453f41c47ef594bc0199803a74
Instruction Fuzzy Hash: FF324370515B108FC328CF29C5905AABBF9BF85700B604A2ED6A787F92D776F845CB10

Function 00AF89A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e39a9dcab4cc64d34283005edf2b4a471055c5ee21ef694df330cb4f99d0527
Instruction ID: c8ce9d85909604107b8259662f6511cf4b9e44cce1337ff89c0d9a07d868c025
Opcode Fuzzy Hash: 4e39a9dcab4cc64d34283005edf2b4a471055c5ee21ef694df330cb4f99d0527
Instruction Fuzzy Hash: 2A02AA74608344DFC704EF68E88062ABBF1EF9A305F09896DE6C987361CB35D814CB92

Function 00AF8A80 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1d4ffc63e4925b11ad2cc48a63ffdfaa2ca2575f9cbf69cf835d4d94a8fa401
Instruction ID: a063bc97ddc34f1eb37bb72a9396c23723190c9766d5a35d1ad38543131a16ac
Opcode Fuzzy Hash: d1d4ffc63e4925b11ad2cc48a63ffdfaa2ca2575f9cbf69cf835d4d94a8fa401
Instruction Fuzzy Hash: D5F18974608344DFC704EF68D88062AFBE5EB9A305F09896DE6C987261DB36D914CB92

Function 00AF8C02 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ae1d5ba376c7d2bb61e3768e54d328bcf0e3b5b75be394a65c26dd4d0dee76
Instruction ID: bfad09594f7d8ed23db83f1002a6377118e6a1abe65857ac5595102ceb0343c4
Opcode Fuzzy Hash: b8ae1d5ba376c7d2bb61e3768e54d328bcf0e3b5b75be394a65c26dd4d0dee76
Instruction Fuzzy Hash: 5BE1AD71618340CFC704DF68E88062AF7E5FB9A315F09896CE6C987361DB36E910CB92

Function 00ABA300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: 813c5ede773a4a9a4e9738b4372b77610e7904ff462d9fcbda46a8a6b18e0bc3
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: 83F1B0756087418FD724CF29C88166BFBE6BFE8300F08882DE4D587752E639E945CB52

Function 00AF8E70 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b0ee9dd29240707e64aa6604710e81aa88c588a5509746050fd5b52055c09c4
Instruction ID: b81b14010d2a5a0896ac9ab5166cdf1b0eb8bd052c58c35b35584874300af10f
Opcode Fuzzy Hash: 2b0ee9dd29240707e64aa6604710e81aa88c588a5509746050fd5b52055c09c4
Instruction Fuzzy Hash: 86D19B7461C284DFD704EF68D88062AFBF5EB9A305F09896DF6C987251DB36D810CB92

Function 00AC4487 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 077bcbc599d3495af1dd7bd02b01172e06b6050f7dad2be8a7e5900e653aa236
Instruction ID: 911064c817500ecb0848494489a850b595cc52a2e04fb72af81abfd2ac821ddb
Opcode Fuzzy Hash: 077bcbc599d3495af1dd7bd02b01172e06b6050f7dad2be8a7e5900e653aa236
Instruction Fuzzy Hash: B8E1FFB5501B408FD325CF28D9A2BA7B7E1FF0A704F04886DE4AA8B752E735B815CB54

Function 00AF6CBF Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 742378752a3d6e6215a95bead1349fe0430e33ab10cdc9daad876c1421592566
Instruction ID: 2de7d28a3b55914f30c9dde6ce97506baab08b90d80d8f80aea3e440bf0b1607
Opcode Fuzzy Hash: 742378752a3d6e6215a95bead1349fe0430e33ab10cdc9daad876c1421592566
Instruction Fuzzy Hash: CAD10136618755CFC720CF78D88452AB7E6FB9A314F098A6CE991C73A1DB30DA44CB91

Function 00AF7AB0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf4cab0f01c5aa09abdd21b358d9349f74c11f119f6f21b06227b0d38ac58ee
Instruction ID: ef57dd4edf70c5f58add5856aeaa97c40f0c428a82c60c209f8968a57267409e
Opcode Fuzzy Hash: 0bf4cab0f01c5aa09abdd21b358d9349f74c11f119f6f21b06227b0d38ac58ee
Instruction Fuzzy Hash: CAB10672A083544BE714DBA8CC41B7FB7E9ABC5314F08492DFA9997382E735DC058792

Function 00ABAF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: a781246c61fea24a996fa12ac9862f43e2ab728dd0aee39da2f1e87212e3f321
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: 1CC18AB2A187418FC370CF28DC96BABB7E5BF85318F08492DD1D9C6242E778A155CB16

Function 00AC6536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09a9026a57bd19a169a8fa5b46850c4c74a9fe7aa7221c44883be9e7abecaad3
Instruction ID: ee09e3499bd06e86d9017444e0976b9065700b2c36ee2295957a4765ff5b9903
Opcode Fuzzy Hash: 09a9026a57bd19a169a8fa5b46850c4c74a9fe7aa7221c44883be9e7abecaad3
Instruction Fuzzy Hash: 72B100B4600B408FD325CF24CA81B67BBF5AF4A704F14885CE8AA8BB52E775F805CB55

Function 00AF7710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 067b5a5850626a46b46d8e027e236a35251ae9abcb444c68d2b46fda9e876251
Instruction ID: 2f92cccc2b6a5c6b673398a8b4a1e6119bd92e94a64ffbe787f3835a452a6f11
Opcode Fuzzy Hash: 067b5a5850626a46b46d8e027e236a35251ae9abcb444c68d2b46fda9e876251
Instruction Fuzzy Hash: 7F917C71A08305ABEB20DF94D880B7FBBE6EB85394F54881CF69597351E730E950CB92

Function 00AFA0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b294e4129bdaffd2bf064303ebc023e9ae6e9ec4f76b09555c6077a896b5819c
Instruction ID: dc067c4fa374ef088208b374f084e937ee3ac4425ad9c8bd5d9336d04476977c
Opcode Fuzzy Hash: b294e4129bdaffd2bf064303ebc023e9ae6e9ec4f76b09555c6077a896b5819c
Instruction Fuzzy Hash: 198170742087099BD724DFA8D880A7AB7F5EF65740F45891CF6898B261E731EC10CB92

Function 00AE64F0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb7f5a666fd08db1c27bc32289c622ff839337099b25c6d24d166d1329a88435
Instruction ID: 7eb4d5e8a1b8bbb5c23997a345c91b9cb4a2dc14ce45bdb02647a7368307be13
Opcode Fuzzy Hash: eb7f5a666fd08db1c27bc32289c622ff839337099b25c6d24d166d1329a88435
Instruction Fuzzy Hash: BC71F733B29AD04BC3149D7E4C463A5BA534BF6374B3DC779A9B48B3E5D6294C064390

Function 00C0F601 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c864820b248cb33547aa1b6441f055bb7aaf0204e925c43e0d9beb1ba4dcf09
Instruction ID: c5c4ab02ae066332e95d5afc6d41fa54aae1e47ccdaf2bd1c69b1c5daf608cb1
Opcode Fuzzy Hash: 0c864820b248cb33547aa1b6441f055bb7aaf0204e925c43e0d9beb1ba4dcf09
Instruction Fuzzy Hash: 2C7126B3A083045FE3046E29DC8476AF7EAEFD4720F2B893DEAC493744E97558058796

Function 00AD28E9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a31f9fab627d624475e4895e39d5e4d42b621050e419514a29b42dc3296547
Instruction ID: 3bae475fd8e51ed18bffde86f2c4cb863a21eb1d43560b722986b36224177a51
Opcode Fuzzy Hash: a2a31f9fab627d624475e4895e39d5e4d42b621050e419514a29b42dc3296547
Instruction Fuzzy Hash: 436167B44183909BD310AF19D851B2ABBF1FFA6750F08491EF4C69B361E33AD910CB66

Function 00AD7C00 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5829a3b196aad509725fe031a891d86583da599edb866d986a7ee891b1cef930
Instruction ID: f0e0bbda25766471ad5ed3ef37d560dc05855d57f98d6f8d16755a92982b604d
Opcode Fuzzy Hash: 5829a3b196aad509725fe031a891d86583da599edb866d986a7ee891b1cef930
Instruction Fuzzy Hash: AF51CCB1618204AFDB249B28CC82BBB33B5EF85768F144959F9868B391F375EC01C761

Function 00AE1860 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: 163d7eb298066db60da0b7203dfe60d32355ab4ad127cad72b84a7f8b0049026
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: 9361CE317093A1ABD714CF2AC58072FBBE2ABC9390F68C93DE4998B351D270DD859742

Function 00AE82D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49cf179ef2dee210249b9c00bb70b29b730aa74ba6fb4cfe957dae732cdee203
Instruction ID: c6b4ce2578d7a3ca9c328660c64d92ef254c50291452cc927b5d32d86b7b00a0
Opcode Fuzzy Hash: 49cf179ef2dee210249b9c00bb70b29b730aa74ba6fb4cfe957dae732cdee203
Instruction Fuzzy Hash: 23615833A5EAD14BC314867E5C553A66A935BD2730F3EC36698B98F3E4CD6D48028351

Function 00BD78DA Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a55614ef658dd858c17428215e9f1886a4b4042163c1856d331538992d8bde9
Instruction ID: c7232cbdeaef5f485ef22f9eaebe9e7c02b3dbbe9ea1f0da434da00fdf29fbc7
Opcode Fuzzy Hash: 8a55614ef658dd858c17428215e9f1886a4b4042163c1856d331538992d8bde9
Instruction Fuzzy Hash: F561F2F3E182144BF708AA29DC95366B6D7DBD4720F2B823DD698D77C4EC798C418285

Function 00AC42FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef1418a315b1f98c2d705b66b3b24d08f176745cec657a4d69cf68d8757265f2
Instruction ID: 335c27bd596d40ff938a61b7070b367a65bfd63d6aed34f42df82d0d7179109b
Opcode Fuzzy Hash: ef1418a315b1f98c2d705b66b3b24d08f176745cec657a4d69cf68d8757265f2
Instruction Fuzzy Hash: D581D4B4810B00AFD360EF39DA47797BEF4AB06201F404A2DE4EA97655E7316459CBE3

Function 00B4E93D Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 167a9be41448bbf312a2fe32de7258f91d88d46cf599645801db2f373772907c
Instruction ID: bec1ac0c8ff8fc4c5bf4810985b55405d3e1724a183f3a9bb58406a497926687
Opcode Fuzzy Hash: 167a9be41448bbf312a2fe32de7258f91d88d46cf599645801db2f373772907c
Instruction Fuzzy Hash: A55104B3E182104BE318AE3CDC9577AB7D6EB94320F17863DEBD993784D939580586C2

Function 00AEE8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: f32d3e99269f0bccfdd612f1ac1618f703e83c06e472e5533a08af2ac597883b
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: 33517DB16087548FE314DF69D49435BBBE1BBC5358F044E2DE4E983350E379DA088B82

Function 00BBF40E Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dc9e9688c3ace8fbedfe41516907b07561bb18583a37221fdf8cd44ca6f6821
Instruction ID: 18f12e701596c889260f9a4aebca4d7cea6c5ecffa69fa3fffda2f471c842c06
Opcode Fuzzy Hash: 9dc9e9688c3ace8fbedfe41516907b07561bb18583a37221fdf8cd44ca6f6821
Instruction Fuzzy Hash: F35149F3A086049BF304AE2CEC4576AB7D5EB94310F26C63DEA85D3788E97D98054687

Function 00AF7520 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2c3bc506b660d89604c40ea4049cd2e29104a64a9eeb123732f9abb88afce21
Instruction ID: e3424c7cde8aca621ce155047728afc99fedb21280769a1fa8ee64c5531792e3
Opcode Fuzzy Hash: c2c3bc506b660d89604c40ea4049cd2e29104a64a9eeb123732f9abb88afce21
Instruction Fuzzy Hash: D351E43160C218ABC715AF58DC90B3EB7E6EB85754F288A2CFAD597391D731EC108B91

Function 00AB5A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b211ce89384a86f5e3133b1d46d6c7cd6d7641fcab65c8dbb5e202e57756d1ee
Instruction ID: 71ada640cf4c780735157fa08ffb47b372f71f7350055135f7b6f1cd4faf632e
Opcode Fuzzy Hash: b211ce89384a86f5e3133b1d46d6c7cd6d7641fcab65c8dbb5e202e57756d1ee
Instruction Fuzzy Hash: 2951D271E047049FC714DF24C890A6ABBA9FF89364F15466CF8999B353DA31EC42CB92

Function 00BE4725 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cb5a0c39caf9e1fddab10077ff2888b20c00f17f25b6f21ef12acb34169eab6
Instruction ID: 3c878e822d0d2095f00bdc36a400a2d6987895c57adf710a4a3e7cfdb40d0159
Opcode Fuzzy Hash: 6cb5a0c39caf9e1fddab10077ff2888b20c00f17f25b6f21ef12acb34169eab6
Instruction Fuzzy Hash: 375104F39183045FE354BE6CDD8667ABBE6EB80720F168A3EE5C4C7344E93548458786

Function 00ADEC48 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e091681e5419b22b807fb44d035a59110eb68f53eaa77b4ab1b43b4973415ef
Instruction ID: 370f07cc86f188f2cf5ed8fa0dc832dd6286b8fb76720fd3dd8ea4cb5b0e95fa
Opcode Fuzzy Hash: 3e091681e5419b22b807fb44d035a59110eb68f53eaa77b4ab1b43b4973415ef
Instruction Fuzzy Hash: 77419074900315DBDF20DF94DC91BA9B7B1FF0A340F144549E985AF3A1EB389951CB91

Function 00AF9B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72e317e317d359bc02442448bfe248d2c6cea66954af96431ad307b38d280d4b
Instruction ID: 49a28c2788d1a6b6bd71b3beba9fab970ddf4044fdf1d40a95f5be6e165a628f
Opcode Fuzzy Hash: 72e317e317d359bc02442448bfe248d2c6cea66954af96431ad307b38d280d4b
Instruction Fuzzy Hash: 91419C34608348AFD720DF95D990B3BBBE6EB95710F24882CF68997251D331EC01CB62

Function 00AC2030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1882725e688728a909f20c70140d138b9a876f473de73a0ec4da8943ba5989d0
Instruction ID: ded402692e2d23236f1323625d1d76ea8fb86e0b29c315323a8979902920a123
Opcode Fuzzy Hash: 1882725e688728a909f20c70140d138b9a876f473de73a0ec4da8943ba5989d0
Instruction Fuzzy Hash: 6F410772A083654FD35CDF2A849473ABBE2AFC4310F0A866EE4E6873D4DA748D45D781

Function 00B349C3 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d82fb03b142d83cc9b0923684ea0a63a127b92428c2dc01dd6613569f9b333
Instruction ID: c950a865159522bef352c0998d81bb0ae85ee63125b3c8120089ae03b52fbb5d
Opcode Fuzzy Hash: 12d82fb03b142d83cc9b0923684ea0a63a127b92428c2dc01dd6613569f9b333
Instruction Fuzzy Hash: 00414CB3B042085BF3546D2DDCD57BBB7D5DB94320F1A013DDB8597780D93A98058386

Function 00AC1E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13595729b57b78caae0ec2fe1154c83bd34d4deb52bb54ccf04017a8a428b35e
Instruction ID: f8a656cf9944410ad2ca1ff48c2371cbf74aeaaf074153466e6506c9d40451a5
Opcode Fuzzy Hash: 13595729b57b78caae0ec2fe1154c83bd34d4deb52bb54ccf04017a8a428b35e
Instruction Fuzzy Hash: 1541ED7460C3809BD320AB59C884F2EFBF5FB86744F14491DF6D497292C37AE8148BA6

Function 00AF8D8A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25f5125e1cab42cd92894f07aa520c468c3b54df708937ce5a1d26898070d9d4
Instruction ID: 73eefb32348daf77a2fba6679d2803fe3d431d90443f6f8b068a4a9145a6ad80
Opcode Fuzzy Hash: 25f5125e1cab42cd92894f07aa520c468c3b54df708937ce5a1d26898070d9d4
Instruction Fuzzy Hash: 0141B13160C2548FC704DFA8C49053EFBE6AF99300F198A1DE5D9D7291DB79DD018B82

Function 00ACD961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 668eb01c2c7700201b8611c8b5a90f6928677c9a31d9ccdf7721e1644db10d92
Instruction ID: 3ce67fa44ed5887c5d5f3d98f2bd8eb1ecc238914482617e03bc5195321d3491
Opcode Fuzzy Hash: 668eb01c2c7700201b8611c8b5a90f6928677c9a31d9ccdf7721e1644db10d92
Instruction Fuzzy Hash: C84178B55083818AD7309F14C881BABB6B0FFA63A0F05096DE48A8BB52E7754940CB57

Function 00AEF030 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: 83bad9ef540c79b3f9000f0199d1cef92b91056cf71bbfd9a2e7f53d0a158abe
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: 132107329082644BC7249B5AC48163BF7E4EB99704F06863EE9C4A7295E3359C1487E1

Function 00AF67EF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cfd636a76aecf876653fcf8dae0e056385f6ed27f370d3591ab18eee03533c3
Instruction ID: aff94ad0c5631694bb6664bd8de185b152af8c582fca19e1069ac687382cc174
Opcode Fuzzy Hash: 7cfd636a76aecf876653fcf8dae0e056385f6ed27f370d3591ab18eee03533c3
Instruction Fuzzy Hash: 963132705183829AE714CF54C490A2FBBF0EF96788F54690CF4C8AB261D338D985CB9A

Function 00AD5E70 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62bf1c59c770ed4f9bd707fd356e98a6e5d0e163c07831bcf92f16dbaaf63969
Instruction ID: 132970a4c2e0cbb057f7b8bb73830665fa3466fa967b5ebc86dda9ec34469b7b
Opcode Fuzzy Hash: 62bf1c59c770ed4f9bd707fd356e98a6e5d0e163c07831bcf92f16dbaaf63969
Instruction Fuzzy Hash: BA21B2709083019BD310AF28C94196BB7F4EF96765F44890DF4D69B392E734DA00CBA3

Function 00AB49A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction ID: a0ccd456b9206577aeb26234a48416633dfae6a7c26a98fa40e017da23223b8a
Opcode Fuzzy Hash: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction Fuzzy Hash: 0731CA316482009FD7149F58D8809ABB7E9EF8C359F18892DE89AD7343D231DC52CB46

Function 00CE9ACD Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1734da491a09c9bdce14539e3f60e8125e2f9e638b86eae9328cf7298dc38ff4
Instruction ID: 34800b7a0b8edbf8d4e08e1c593461d27c7c402348c051160db5b56c9f9865ea
Opcode Fuzzy Hash: 1734da491a09c9bdce14539e3f60e8125e2f9e638b86eae9328cf7298dc38ff4
Instruction Fuzzy Hash: 123129B211C600AFE70ABF29D8917BEF7E6EF98311F06892DE7C583650E73154418A5B

Function 00AF64B8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c191de6b67e35eb84c0d73f55ec1ebc609a934ea50e4b54ec6c5cdcd1074021b
Instruction ID: f6ee69b7c8d231ec6314ccdc684aea72e8b812f50b93b0c368809d0716f65b6a
Opcode Fuzzy Hash: c191de6b67e35eb84c0d73f55ec1ebc609a934ea50e4b54ec6c5cdcd1074021b
Instruction Fuzzy Hash: EC21667060C2049BC714EF99D680A2EFBF6EB95741F28881CE5C597261C731AC50DB62

Function 00AC0EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27c042fabeafed5a4bb663f7356542375d19265d2938449ebb72ec6356a2fbfa
Instruction ID: 7333057652de67fd034c96dd8d0a0b16fef08766bf596a277e31059cb9cc9cae
Opcode Fuzzy Hash: 27c042fabeafed5a4bb663f7356542375d19265d2938449ebb72ec6356a2fbfa
Instruction Fuzzy Hash: 3021E6B490021A9FDB15CF95CC90FBEBBB1FB4A304F144859E511AB292C735A951CBA4

Function 00AEB650 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 7d133d74dad506134abf91a9073f85790fa8c26543c9116fafde397241c667d9
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: D511E533A151E90EC7168E3D8444566BFA31AA3234B598399F4B89B2D2D7328D8A9374

Function 00D9983D Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 690a9b5e26606be5e6f893084969b27b7a5a190d8bd921269ef068135eb87ad3
Instruction ID: d8bc3f07fe93a99697284a06fff48165481029627e7dedb3b042ecd5b4382a66
Opcode Fuzzy Hash: 690a9b5e26606be5e6f893084969b27b7a5a190d8bd921269ef068135eb87ad3
Instruction Fuzzy Hash: B011E77210C6059FE340AE7D989153BF7E5FF88720F75892ED6D2C6244E67088459BA3

Function 00AE0B80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: a7a6d245fb1f428183d1e53b4b289c030a8b2670b41b8b352a7adef8849ce594
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: AA0184F6E0038247E720DF5695D1F3BB2A9BF80B68F18452CE84657302DBB5EC45C6A1

Function 00ADD1E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 855f9b2135e2959353e1da77e6c0a77f2ad1bca2c6604537acfaffd13b8969f2
Instruction ID: bd9dd21f2436295e0e718b8765790aee66140891e27c9432d42aefe0fcddd4f8
Opcode Fuzzy Hash: 855f9b2135e2959353e1da77e6c0a77f2ad1bca2c6604537acfaffd13b8969f2
Instruction Fuzzy Hash: 6511ECB0408380AFD3209F618584A2FFBE5EBA6714F148C0DF6A59B251C779E819CF56

Function 00AB6EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c183a71ce62f4b325d707c7b699155774a1ab2192d3303887e87dc949ba5119
Instruction ID: 498dfc892aec24febec5345fe4f599e170609ae047732808deea7c522b64bec2
Opcode Fuzzy Hash: 7c183a71ce62f4b325d707c7b699155774a1ab2192d3303887e87dc949ba5119
Instruction Fuzzy Hash: 52F0E03E7152190B6210CEFAE884877F3EAD7D9355B155538EE41D3202DD75EC0791D4

Function 00AEB8C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 00ACC5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 00ACB410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: ec552a336fc90466b57f34b7da8f5644536e80530cd3153c8328a76375a31ba6
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: D1F0ECB161851057DF36CA599CC1F37BB9CCB87354F1A042EE84557143D2725849C3F5

Function 00AE8220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd53b18d9c0a3ef2111070810653c6f312a4732305b3d8080228d209311dd15b
Instruction ID: d455d7f8ce1394745205fe374437d2e07197543e9da5bfa6b7a389c0da3cbabb
Opcode Fuzzy Hash: bd53b18d9c0a3ef2111070810653c6f312a4732305b3d8080228d209311dd15b
Instruction Fuzzy Hash: 1201E4B04107009FC360EF29C545757BBE8EB08714F004A1DE8AECB680D770A544CF82

Function 00AF1440 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: d4060479d4f0d72b7c5c6e08a5c0ea13d17ef604243c2e3c953ad7787a7ed81b
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 19D0A771608321869F748F19A400977F7F0EAC7B12F89955EF686E3148D330DC41C2A9

Function 00AC1ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f68c3e047f38c7cea759f80a638526a870602c779708fb3153f6f441f4857c
Instruction ID: 5ec67bc7c9dd6ff000476bd15e914f57b9f577e8b1d3f4b8940da94b76ca44a7
Opcode Fuzzy Hash: c0f68c3e047f38c7cea759f80a638526a870602c779708fb3153f6f441f4857c
Instruction Fuzzy Hash: 99C00234A691018FC244DF95A895A36A6B8AB5720A750602ADA03E7662DA60D417D909

Function 00AF6094 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46130acf35b7a7a8475a5d6a1edb7625d2f5503dcaa9f57c6dff8f8d65b93296
Instruction ID: 7a4e105bd3c02ea19e6cd4ade5de582477c096fdea0034116b4109b98c2f5a78
Opcode Fuzzy Hash: 46130acf35b7a7a8475a5d6a1edb7625d2f5503dcaa9f57c6dff8f8d65b93296
Instruction Fuzzy Hash: A1C02238A2C00083E28CCF08E800830F3FE8BABF0CB20B00EC80223382C830C002CA0C

Function 00AC1A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b05b242e9df3b7aace6c87821286732e49b0dcbdf38807e29d9145c36d860db9
Instruction ID: 96669de5860b4df14298bb6fa1055a437718150fc59868653d4f0d021f12dc17
Opcode Fuzzy Hash: b05b242e9df3b7aace6c87821286732e49b0dcbdf38807e29d9145c36d860db9
Instruction Fuzzy Hash: 83C04C34A690408EC244CEC5A8D1531A2B85707209710303A9A03E7262C560D406D509

Function 00AF5FD6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1759989830.0000000000AB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1759975570.0000000000AB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000C99000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760026620.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760281954.0000000000DC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760388849.0000000000F69000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc08b47ce8fc65b131d326a71e85f76cc9bed51e1f6c194dad1f7821c51b4e1d
Instruction ID: 3395af4e6bf907d54a871a894ef2889b9eff82cbc09a8bc450df14691d6fb90d
Opcode Fuzzy Hash: cc08b47ce8fc65b131d326a71e85f76cc9bed51e1f6c194dad1f7821c51b4e1d
Instruction Fuzzy Hash: 28C09224B690008BE28CCF19DD55A35F6FE9BABE1CB14B02DC806A3256D934D512860C

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
file.exe

Function 00AF50FA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63
libraryCOMMON

Function 00ABFCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Function 00ABD110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Function 00AF5700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Function 00AF5BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 00AF695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Function 00AC049B Relevance: .3, Instructions: 264
COMMON

Function 00AF3220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 00AF3202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON