Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1527574
MD5:	c461a62ec008b2a001dfb3f58ba3cfaa
SHA1:	cff4b40928bd2e8f0c212e5a8fa7a3693d2ba7d3
SHA256:	aecc7f82d4dd048f1c05484ebd338e3d0738468729c61af73c39f2bce62cc7ea
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7052 cmdline: "C:\Users\user\Desktop\file.exe" MD5: C461A62EC008B2A001DFB3F58BA3CFAA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["studennotediw.stor", "licendfilteo.site", "spirittunek.stor", "dissapoiznw.stor", "clearancek.site", "bathdoomgaz.stor", "eaglepawnoy.stor", "mobbipenju.stor"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T04:05:02.394099+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	58160	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T04:05:02.314150+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	61485	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T04:05:02.373412+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	60448	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T04:05:02.362870+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	50149	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T04:05:02.414238+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	49221	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T04:05:02.353408+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	53457	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T04:05:02.403281+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	59587	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T04:05:02.383260+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	57609	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900

URL Reputation: Label: malware

Found malware configuration

Source: file.exe.7052.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["studennotediw.stor", "licendfilteo.site", "spirittunek.stor", "dissapoiznw.stor", "clearancek.site", "bathdoomgaz.stor", "eaglepawnoy.stor", "mobbipenju.stor"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for domain / URL

Source: https://clearancek.site:443/api	Virustotal: Detection: 13%	Perma Link
Source: https://licendfilteo.site:443/api	Virustotal: Detection: 12%	Perma Link
Source: https://studennotediw.store:443/api&	Virustotal: Detection: 8%	Perma Link
Source: https://eaglepawnoy.store:443/api	Virustotal: Detection: 13%	Perma Link
Source: https://steamcommunity.com:443/profiles/76561199724331900	Virustotal: Detection: 8%	Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.stor
Source: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.stor
Source: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.stor
Source: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.stor
Source: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.stor
Source: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.stor
Source: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_004CD110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_004CD110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_005063B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00505700
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_0050695B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_005099D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_004CFCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_004D0EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00504040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_004D6F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then dec ebx	0_2_004FF030
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00506094
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_004ED1E1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_004E2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_004E2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_004D42FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	0_2_004CA300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_004F23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_004F23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_004F23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_004F23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_004F23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_004F23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_00501440
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_004DD457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_004EC470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_004EE40C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_004DB410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_005064B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_004E9510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_00507520
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_004D6536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_004FB650
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_004EE66A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_00507710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_005067EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_004ED7AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_004E28E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_004DD961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00503920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_004C49A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00504A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_004C5A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_004D1A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_004D1ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_004DDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_004DDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00509B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_004D1BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_004D3BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_004F0B80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_004EEC48
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_004E7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_004FFC20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_004ECCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_004ECCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_004ECCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00509CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00509CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_004EAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_004EAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_004EFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_004EDD29
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00508D8A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_004EAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_004E7E60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_004E5E70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, ecx	0_2_004D4E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_004D1E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_004C6EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_004D6EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_004CBEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_004E9F62
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_004FFF70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00505FD6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00507FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00507FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_004DFFDF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_004C8FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_004D6F91

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:60448 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:49221 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:59587 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:61485 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:57609 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:50149 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:53457 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:58160 -> 1.1.1.1:53

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: studennotediw.stor
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: spirittunek.stor
Source: Malware configuration extractor	URLs: dissapoiznw.stor
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: bathdoomgaz.stor
Source: Malware configuration extractor	URLs: eaglepawnoy.stor
Source: Malware configuration extractor	URLs: mobbipenju.stor

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: //.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.1736570250.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1757483974.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https: equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=80e320c054f52e6baceca204; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type25489Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 07 Oct 2024 02:05:03 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000000.00000003.1736486716.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.1736486716.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1736486716.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000000.00000002.1757353177.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736486716.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/api
Source: file.exe, 00000000.00000002.1757353177.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736486716.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/apiiY
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: file.exe, 00000000.00000003.1736486716.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: file.exe, 00000000.00000003.1736486716.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000002.1757176256.0000000000E35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: file.exe, 00000000.00000002.1757176256.0000000000E35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
Source: file.exe, 00000000.00000002.1757176256.0000000000E35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: file.exe, 00000000.00000002.1757353177.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736486716.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eaglepawnoy.store:443/api
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000000.00000002.1757353177.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736486716.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site:443/api
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000000.00000003.1736486716.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736486716.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.1736486716.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000003.1736486716.0000000000E61000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1757353177.0000000000E61000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1757353177.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736486716.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000002.1757353177.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736486716.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.1736439945.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000000.00000003.1736439945.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.1736486716.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000002.1757353177.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736486716.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://studennotediw.store:443/api&
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000003.1736486716.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D0228	0_2_004D0228
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00504040	0_2_00504040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D2030	0_2_004D2030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050A0D0	0_2_0050A0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C5160	0_2_004C5160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C71F0	0_2_004C71F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004CE1A0	0_2_004CE1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005411A4	0_2_005411A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00759215	0_2_00759215
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F82D0	0_2_004F82D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F12D0	0_2_004F12D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E32B8	0_2_005E32B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068B34A	0_2_0068B34A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004CA300	0_2_004CA300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F23E0	0_2_004F23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004CB3A0	0_2_004CB3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00686392	0_2_00686392
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067C460	0_2_0067C460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EC470	0_2_004EC470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F64F0	0_2_004F64F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D4487	0_2_004D4487
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D049B	0_2_004D049B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C85CA	0_2_006C85CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004DC5F0	0_2_004DC5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C35B0	0_2_004C35B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00508652	0_2_00508652
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FF620	0_2_004FF620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005086F0	0_2_005086F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057169E	0_2_0057169E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F072B	0_2_005F072B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F1860	0_2_004F1860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB8C0	0_2_004FB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FE8A0	0_2_004FE8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067F93A	0_2_0067F93A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006899F1	0_2_006899F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E098B	0_2_004E098B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005089A0	0_2_005089A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00504A40	0_2_00504A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00508A80	0_2_00508A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00507AB0	0_2_00507AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004DDB6F	0_2_004DDB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0065CB4D	0_2_0065CB4D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C7BF0	0_2_004C7BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00508C02	0_2_00508C02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004ECCD0	0_2_004ECCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00506CBF	0_2_00506CBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E8D62	0_2_004E8D62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EFD10	0_2_004EFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EDD29	0_2_004EDD29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067DE60	0_2_0067DE60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EAE57	0_2_004EAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00508E70	0_2_00508E70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00682E2D	0_2_00682E2D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D4E2A	0_2_004D4E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00687EDB	0_2_00687EDB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D6EBF	0_2_004D6EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004CBEB0	0_2_004CBEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064BF62	0_2_0064BF62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057EF40	0_2_0057EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004CAF10	0_2_004CAF10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00507FC0	0_2_00507FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C8FD0	0_2_004C8FD0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 004DD300 appears 148 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 004CCAA0 appears 48 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9995423370462047
Source: file.exe	Static PE information: Section: smlnkmvk ZLIB complexity 0.9944469146303743

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@9/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F8220 CoCreateInstance,

0_2_004F8220

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior

Source: file.exe

Static file information: File size 1825280 > 1048576

Source: file.exe

Static PE information: Raw size of smlnkmvk is bigger than: 0x100000 < 0x194200

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.4c0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;smlnkmvk:EW;ameacfcj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;smlnkmvk:EW;ameacfcj:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c731d should be: 0x1c14d1

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: smlnkmvk
Source: file.exe	Static PE information: section name: ameacfcj
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0074202B push ebx; mov dword ptr [esp], ecx	0_2_0074204D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0074202B push 1E04D762h; mov dword ptr [esp], esp	0_2_00742091
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077B0A3 push ebx; mov dword ptr [esp], edi	0_2_0077B0C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077B0A3 push 2DADB817h; mov dword ptr [esp], ebx	0_2_0077B125
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B5123 push 385E44C0h; mov dword ptr [esp], edx	0_2_006B52C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009511CF push 721AC2ACh; mov dword ptr [esp], esi	0_2_009511ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009511CF push 27B53200h; mov dword ptr [esp], eax	0_2_009511FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009511CF push 37211CCDh; mov dword ptr [esp], edx	0_2_00951211
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009511CF push eax; mov dword ptr [esp], ebx	0_2_00951261
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009511CF push 1BD68A2Fh; mov dword ptr [esp], ebx	0_2_00951304
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0074E11A push ecx; mov dword ptr [esp], 3C1E53DFh	0_2_0074E17F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0074E11A push edx; mov dword ptr [esp], ebp	0_2_0074E19E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0070E1FA push 30D16AA1h; mov dword ptr [esp], edi	0_2_0070E6EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0070E1FA push 776A3967h; mov dword ptr [esp], esp	0_2_0070E6F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007071E5 push edi; mov dword ptr [esp], ebp	0_2_007071F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005411A4 push ebx; mov dword ptr [esp], ecx	0_2_0054124B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005411A4 push ebp; mov dword ptr [esp], edx	0_2_00541256
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005411A4 push 6F7A1121h; mov dword ptr [esp], ecx	0_2_00541325
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005411A4 push eax; mov dword ptr [esp], ebp	0_2_00541335
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005411A4 push ecx; mov dword ptr [esp], 39079F73h	0_2_0054136C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00527212 push 462FD45Fh; mov dword ptr [esp], ebx	0_2_0052725C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00759215 push eax; mov dword ptr [esp], ebp	0_2_00759257
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00759215 push edx; mov dword ptr [esp], 3FD59C81h	0_2_00759290
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00759215 push 35E374BFh; mov dword ptr [esp], ebp	0_2_0075932C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00754202 push eax; mov dword ptr [esp], edi	0_2_0075427C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077F2D2 push eax; mov dword ptr [esp], ebp	0_2_0077F64B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E32B8 push eax; mov dword ptr [esp], esi	0_2_005E32D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E32B8 push esi; mov dword ptr [esp], ecx	0_2_005E32EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E32B8 push edi; mov dword ptr [esp], ecx	0_2_005E34DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E32B8 push 628A3036h; mov dword ptr [esp], esi	0_2_005E3524
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E32B8 push 5FA8EA39h; mov dword ptr [esp], ecx	0_2_005E3542

Source: file.exe	Static PE information: section name: entropy: 7.981559310491324
Source: file.exe	Static PE information: section name: smlnkmvk entropy: 7.953849137350641

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69110E second address: 691112 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690116 second address: 690135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8890E9C2B9h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690135 second address: 69013D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69081D second address: 690825 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690825 second address: 690829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690829 second address: 69082F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690986 second address: 6909A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F88914C929Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6909A0 second address: 6909A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6923FA second address: 69243A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C92A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push edi 0x0000000e jmp 00007F88914C929Fh 0x00000013 pop edi 0x00000014 mov eax, dword ptr [eax] 0x00000016 jo 00007F88914C92A2h 0x0000001c jo 00007F88914C929Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69243A second address: 69244A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp+04h], eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69244A second address: 692459 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F88914C929Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692459 second address: 69245D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69245D second address: 6924C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push 00000003h 0x0000000b mov edx, dword ptr [ebp+122D389Fh] 0x00000011 push 00000000h 0x00000013 push 00000003h 0x00000015 and si, 8171h 0x0000001a mov edx, eax 0x0000001c push 6006D55Ch 0x00000021 push edx 0x00000022 pushad 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 push eax 0x00000026 pop eax 0x00000027 popad 0x00000028 pop edx 0x00000029 add dword ptr [esp], 5FF92AA4h 0x00000030 add ecx, dword ptr [ebp+122D1DA4h] 0x00000036 mov edi, 42E3E9F2h 0x0000003b lea ebx, dword ptr [ebp+12442278h] 0x00000041 movzx edi, ax 0x00000044 xchg eax, ebx 0x00000045 pushad 0x00000046 jc 00007F88914C92AAh 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F88914C929Ah 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692607 second address: 692630 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007F8890E9C2B5h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692630 second address: 69263D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jbe 00007F88914C929Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69263D second address: 6926C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dh, bl 0x00000008 push 00000003h 0x0000000a movsx esi, si 0x0000000d push 00000000h 0x0000000f movsx ecx, di 0x00000012 push 00000003h 0x00000014 jmp 00007F8890E9C2AEh 0x00000019 call 00007F8890E9C2A9h 0x0000001e jc 00007F8890E9C2BBh 0x00000024 jmp 00007F8890E9C2B5h 0x00000029 push eax 0x0000002a push ebx 0x0000002b jnl 00007F8890E9C2ACh 0x00000031 pop ebx 0x00000032 mov eax, dword ptr [esp+04h] 0x00000036 js 00007F8890E9C2AEh 0x0000003c push edx 0x0000003d je 00007F8890E9C2A6h 0x00000043 pop edx 0x00000044 mov eax, dword ptr [eax] 0x00000046 jg 00007F8890E9C2B4h 0x0000004c mov dword ptr [esp+04h], eax 0x00000050 push ebx 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 pop eax 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6926C3 second address: 6926E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pop eax 0x00000008 xor dword ptr [ebp+122D2480h], edi 0x0000000e lea ebx, dword ptr [ebp+12442281h] 0x00000014 mov dword ptr [ebp+122D204Dh], edx 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pop edx 0x00000020 pop eax 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69276E second address: 692806 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8890E9C2B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c clc 0x0000000d push 00000000h 0x0000000f pushad 0x00000010 and edx, 6F7D1AFCh 0x00000016 popad 0x00000017 push 48D3E4D1h 0x0000001c jmp 00007F8890E9C2B5h 0x00000021 xor dword ptr [esp], 48D3E451h 0x00000028 and esi, dword ptr [ebp+122D35E7h] 0x0000002e push 00000003h 0x00000030 mov dword ptr [ebp+122D1CF6h], ecx 0x00000036 push 00000000h 0x00000038 mov dword ptr [ebp+122D33D7h], edi 0x0000003e push 00000003h 0x00000040 mov ecx, dword ptr [ebp+122D3104h] 0x00000046 call 00007F8890E9C2A9h 0x0000004b push ecx 0x0000004c push esi 0x0000004d pushad 0x0000004e popad 0x0000004f pop esi 0x00000050 pop ecx 0x00000051 push eax 0x00000052 push ecx 0x00000053 jmp 00007F8890E9C2AEh 0x00000058 pop ecx 0x00000059 mov eax, dword ptr [esp+04h] 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007F8890E9C2AFh 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692806 second address: 69280A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69280A second address: 692810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692810 second address: 692816 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692816 second address: 69281A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69281A second address: 692829 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A5D52 second address: 6A5D57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B441C second address: 6B442D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jp 00007F88914ACC06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2831 second address: 6B2835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2835 second address: 6B2853 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F88914ACC0Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jo 00007F88914ACC06h 0x00000012 push edx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2AE3 second address: 6B2AE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2AE7 second address: 6B2AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2C30 second address: 6B2C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jo 00007F88914C26C2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2C3F second address: 6B2C45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2C45 second address: 6B2C4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2C4D second address: 6B2C63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F88914ACC12h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2C63 second address: 6B2C67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2D91 second address: 6B2DB6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F88914ACC0Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F88914ACC17h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B304E second address: 6B3052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3052 second address: 6B307B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F88914ACC19h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B307B second address: 6B3089 instructions: 0x00000000 rdtsc 0x00000002 js 00007F88914C26B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3089 second address: 6B308D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB146 second address: 6AB14C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB14C second address: 6AB161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F88914ACC0Ch 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB161 second address: 6AB165 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB165 second address: 6AB16B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB16B second address: 6AB171 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB171 second address: 6AB175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B42C5 second address: 6B42C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B90C5 second address: 6B90D3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F88914ACC06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B90D3 second address: 6B90D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B95A7 second address: 6B95AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B96E2 second address: 6B96E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B97FF second address: 6B980A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F88914ACC06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B99A2 second address: 6B99A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BFE24 second address: 6BFE2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0221 second address: 6C023E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F88914C26C5h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C023E second address: 6C025D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F88914ACC17h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1C30 second address: 6C1C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1C34 second address: 6C1C38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1C38 second address: 6C1C4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F88914C26B8h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1C4A second address: 6C1C65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F88914ACC17h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1C65 second address: 6C1C69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1DF5 second address: 6C1DF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1DF9 second address: 6C1DFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C23F6 second address: 6C23FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C23FB second address: 6C2402 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C246C second address: 6C2470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C287C second address: 6C2882 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2A62 second address: 6C2A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2F4F second address: 6C2F61 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C390A second address: 6C3928 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914ACC0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jbe 00007F88914ACC1Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4053 second address: 6C405D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F88914C26B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C506A second address: 6C5070 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C405D second address: 6C4061 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5EA3 second address: 6C5EA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5EA7 second address: 6C5EAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5EAB second address: 6C5EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5EB5 second address: 6C5EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C68FB second address: 6C690F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jns 00007F88914ACC06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C690F second address: 6C6914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C928C second address: 6C9297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9297 second address: 6C92E4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F88914C26B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007F88914C26BCh 0x00000013 jnl 00007F88914C26B6h 0x00000019 pop edx 0x0000001a nop 0x0000001b mov edi, dword ptr [ebp+122D36A7h] 0x00000021 push 00000000h 0x00000023 movzx edi, di 0x00000026 push 00000000h 0x00000028 mov edi, edx 0x0000002a xchg eax, ebx 0x0000002b push ecx 0x0000002c push edi 0x0000002d pushad 0x0000002e popad 0x0000002f pop edi 0x00000030 pop ecx 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F88914C26C9h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD497 second address: 6CD49C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CE3BA second address: 6CE3BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CE3BE second address: 6CE3C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC562 second address: 6CC5FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F88914C26B6h 0x00000009 jns 00007F88914C26B6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 xor di, 6526h 0x00000018 mov ebx, eax 0x0000001a push dword ptr fs:[00000000h] 0x00000021 xor dword ptr [ebp+122D3039h], ebx 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e push 00000000h 0x00000030 push esi 0x00000031 call 00007F88914C26B8h 0x00000036 pop esi 0x00000037 mov dword ptr [esp+04h], esi 0x0000003b add dword ptr [esp+04h], 0000001Bh 0x00000043 inc esi 0x00000044 push esi 0x00000045 ret 0x00000046 pop esi 0x00000047 ret 0x00000048 jnl 00007F88914C26C0h 0x0000004e mov eax, dword ptr [ebp+122D1769h] 0x00000054 sub dword ptr [ebp+1246558Fh], esi 0x0000005a push FFFFFFFFh 0x0000005c push 00000000h 0x0000005e push edi 0x0000005f call 00007F88914C26B8h 0x00000064 pop edi 0x00000065 mov dword ptr [esp+04h], edi 0x00000069 add dword ptr [esp+04h], 00000014h 0x00000071 inc edi 0x00000072 push edi 0x00000073 ret 0x00000074 pop edi 0x00000075 ret 0x00000076 push ebx 0x00000077 mov dword ptr [ebp+122D23D9h], ecx 0x0000007d pop ebx 0x0000007e nop 0x0000007f push eax 0x00000080 push edx 0x00000081 push eax 0x00000082 push edx 0x00000083 push eax 0x00000084 push edx 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CE62F second address: 6CE633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD5F2 second address: 6CD5F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC5FC second address: 6CC600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF3BA second address: 6CF3BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CE633 second address: 6CE639 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC600 second address: 6CC604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC604 second address: 6CC60A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF539 second address: 6CF53D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D0612 second address: 6D0616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D23A9 second address: 6D240A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F88914C26C6h 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F88914C26B8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 mov ebx, dword ptr [ebp+122D388Bh] 0x0000002c push 00000000h 0x0000002e xor dword ptr [ebp+122D1CD7h], edi 0x00000034 push 00000000h 0x00000036 mov edi, dword ptr [ebp+122D55D6h] 0x0000003c xchg eax, esi 0x0000003d jmp 00007F88914C26BAh 0x00000042 push eax 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 push edi 0x00000047 pop edi 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3389 second address: 6D33E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914ACC16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov di, DD52h 0x00000011 push 00000000h 0x00000013 add dword ptr [ebp+122D23C9h], eax 0x00000019 push 00000000h 0x0000001b jnl 00007F88914ACC20h 0x00000021 xchg eax, esi 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F88914ACC0Ch 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D264A second address: 6D2654 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F88914C26B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D33E4 second address: 6D33EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D33EA second address: 6D33EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D66CD second address: 6D66D7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F88914ACC0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D76E7 second address: 6D76ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D76ED second address: 6D76F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D76F3 second address: 6D76F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D76F7 second address: 6D7784 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F88914ACC08h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 mov dword ptr [ebp+1243D950h], ecx 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ecx 0x00000032 call 00007F88914ACC08h 0x00000037 pop ecx 0x00000038 mov dword ptr [esp+04h], ecx 0x0000003c add dword ptr [esp+04h], 00000015h 0x00000044 inc ecx 0x00000045 push ecx 0x00000046 ret 0x00000047 pop ecx 0x00000048 ret 0x00000049 jmp 00007F88914ACC10h 0x0000004e xchg eax, esi 0x0000004f jc 00007F88914ACC0Eh 0x00000055 jl 00007F88914ACC08h 0x0000005b push ebx 0x0000005c pop ebx 0x0000005d push eax 0x0000005e pushad 0x0000005f pushad 0x00000060 jmp 00007F88914ACC17h 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D86B1 second address: 6D86B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D86B5 second address: 6D86BF instructions: 0x00000000 rdtsc 0x00000002 jc 00007F88914ACC0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D86BF second address: 6D871E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F88914C26B8h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 mov edi, ecx 0x00000023 push 00000000h 0x00000025 mov ebx, dword ptr [ebp+122D37A7h] 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edi 0x00000030 call 00007F88914C26B8h 0x00000035 pop edi 0x00000036 mov dword ptr [esp+04h], edi 0x0000003a add dword ptr [esp+04h], 00000015h 0x00000042 inc edi 0x00000043 push edi 0x00000044 ret 0x00000045 pop edi 0x00000046 ret 0x00000047 mov di, 9DB1h 0x0000004b movzx edi, cx 0x0000004e push eax 0x0000004f jo 00007F88914C26C4h 0x00000055 push eax 0x00000056 push edx 0x00000057 push edi 0x00000058 pop edi 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D871E second address: 6D8722 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D58D3 second address: 6D58D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA4CC second address: 6DA55C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 xor edi, 5BB8CAA8h 0x0000000f or dword ptr [ebp+122D2AE8h], eax 0x00000015 push 00000000h 0x00000017 call 00007F88914ACC19h 0x0000001c mov ebx, dword ptr [ebp+122D36DBh] 0x00000022 pop edi 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007F88914ACC08h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 00000018h 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f xchg eax, esi 0x00000040 jp 00007F88914ACC18h 0x00000046 jmp 00007F88914ACC12h 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F88914ACC19h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA55C second address: 6DA574 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C26C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D46DC second address: 6D474C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914ACC17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push dword ptr fs:[00000000h] 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F88914ACC08h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b add bh, FFFFFFAFh 0x0000002e mov dword ptr fs:[00000000h], esp 0x00000035 mov dword ptr [ebp+1246551Ah], esi 0x0000003b mov eax, dword ptr [ebp+122D01E1h] 0x00000041 push FFFFFFFFh 0x00000043 call 00007F88914ACC0Ah 0x00000048 mov dword ptr [ebp+1243DAE4h], edi 0x0000004e pop ebx 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 push edx 0x00000054 pop edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DB5B8 second address: 6DB64F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 mov ebx, dword ptr [ebp+122D35F7h] 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F88914C26B8h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007F88914C26B8h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 00000018h 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 call 00007F88914C26C7h 0x0000004c mov edi, dword ptr [ebp+122D37F7h] 0x00000052 pop ebx 0x00000053 add edi, dword ptr [ebp+122D354Bh] 0x00000059 xchg eax, esi 0x0000005a jmp 00007F88914C26C6h 0x0000005f push eax 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8949 second address: 6D894F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D894F second address: 6D8953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E37DA second address: 6E37DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6843C0 second address: 6843DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 jp 00007F88914C26BEh 0x0000000d jns 00007F88914C26B6h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push esi 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E338C second address: 6E3394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E3394 second address: 6E339C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E339C second address: 6E33A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E33A3 second address: 6E33AD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F88914C26C8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E33AD second address: 6E33D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F88914ACC0Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007F88914ACC12h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB72B second address: 6EB731 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB731 second address: 6EB735 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB735 second address: 6EB74C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jns 00007F88914C26B6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB74C second address: 6EB751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB751 second address: 6EB756 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB837 second address: 6EB83D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D9BD second address: 67D9C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D9C3 second address: 67D9C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DB765 second address: 6DB80D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov ebx, dword ptr [ebp+122D3717h] 0x00000011 push dword ptr fs:[00000000h] 0x00000018 mov di, ax 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 xor ebx, 692C4AC2h 0x00000028 jnl 00007F88914C0B0Ch 0x0000002e mov eax, dword ptr [ebp+122D0255h] 0x00000034 push 00000000h 0x00000036 push eax 0x00000037 call 00007F88914C0B08h 0x0000003c pop eax 0x0000003d mov dword ptr [esp+04h], eax 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc eax 0x0000004a push eax 0x0000004b ret 0x0000004c pop eax 0x0000004d ret 0x0000004e push FFFFFFFFh 0x00000050 mov edi, dword ptr [ebp+122D37AFh] 0x00000056 mov ebx, dword ptr [ebp+122D1CA9h] 0x0000005c nop 0x0000005d jmp 00007F88914C0B17h 0x00000062 push eax 0x00000063 pushad 0x00000064 pushad 0x00000065 jmp 00007F88914C0B19h 0x0000006a pushad 0x0000006b popad 0x0000006c popad 0x0000006d push eax 0x0000006e push edx 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DB80D second address: 6DB811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0466 second address: 6F046A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F046A second address: 6F0476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0476 second address: 6F047A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F047A second address: 6F0486 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0486 second address: 6F048A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F048A second address: 6F0490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0E3B second address: 6F0E4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F88914C0B0Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0E4D second address: 6F0E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0E53 second address: 6F0E60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F88914C0B06h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0F98 second address: 6F0F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0F9E second address: 6F0FB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop edi 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0FB3 second address: 6F0FB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F116C second address: 6F1171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F1171 second address: 6F1176 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F12AA second address: 6F12B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F2E71 second address: 6F2E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F2E77 second address: 6F2EB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C0B16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop ebx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F88914C0B18h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F2EB5 second address: 6F2EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F88914C4376h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4478 second address: 6F4490 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F88914C0B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b jbe 00007F88914C0B49h 0x00000011 pushad 0x00000012 push edi 0x00000013 pop edi 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4490 second address: 6F4496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4496 second address: 6F44A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F88914C0B06h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F44A5 second address: 6F44A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F44A9 second address: 6F44AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 685EE6 second address: 685EEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F8ED5 second address: 6F8ED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F8ED9 second address: 6F8EF2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F88914C4376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007F88914C437Bh 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F8EF2 second address: 6F8EF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F8EF7 second address: 6F8F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F88914C4385h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F8F12 second address: 6F8F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F88914C0B0Eh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F923E second address: 6F9257 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C4383h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F996A second address: 6F9972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F9972 second address: 6F9977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F9977 second address: 6F9983 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7015D9 second address: 7015FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 js 00007F88914C4393h 0x0000000c pushad 0x0000000d jmp 00007F88914C437Dh 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 pop eax 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA314 second address: 6CA318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA318 second address: 6CA325 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA325 second address: 6AB146 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C0B0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a nop 0x0000000b mov ecx, 33B90164h 0x00000010 call dword ptr [ebp+122D206Dh] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jbe 00007F88914C0B06h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA713 second address: 6CA717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA717 second address: 6CA748 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C0B16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jmp 00007F88914C0B12h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA748 second address: 6CA74E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA74E second address: 6CA752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA876 second address: 6CA87A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA87A second address: 6CA8AC instructions: 0x00000000 rdtsc 0x00000002 je 00007F88914C0B1Ah 0x00000008 jmp 00007F88914C0B14h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F88914C0B0Fh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA8AC second address: 6CA8B6 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F88914C4376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA8B6 second address: 6CA8D0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F88914C0B0Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA8D0 second address: 6CA8D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA8D4 second address: 6CA8DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA8DA second address: 6CA905 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F88914C4378h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f push ebx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 jmp 00007F88914C4385h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA905 second address: 6CA914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA914 second address: 6CA918 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA918 second address: 6CA958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F88914C0B08h 0x0000000c popad 0x0000000d pop eax 0x0000000e jc 00007F88914C0B0Ch 0x00000014 adc edx, 7079E842h 0x0000001a call 00007F88914C0B09h 0x0000001f push ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F88914C0B18h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA958 second address: 6CA966 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA966 second address: 6CA96A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA96A second address: 6CA97E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C4380h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA97E second address: 6CA9AB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 js 00007F88914C0B06h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 jmp 00007F88914C0B14h 0x00000016 push eax 0x00000017 push edx 0x00000018 ja 00007F88914C0B06h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA9AB second address: 6CA9B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA9B9 second address: 6CA9C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CAB1B second address: 6CAB1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CAB1F second address: 6CAB23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CAB23 second address: 6CAB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F88914C4376h 0x0000000d jmp 00007F88914C437Eh 0x00000012 popad 0x00000013 popad 0x00000014 mov dword ptr [esp], esi 0x00000017 mov cl, bl 0x00000019 js 00007F88914C437Ch 0x0000001f mov dword ptr [ebp+122D1E73h], esi 0x00000025 nop 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F88914C4387h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB1E8 second address: 6CB1F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7008B1 second address: 7008B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700A23 second address: 700A2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F88914C0B06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700BB3 second address: 700BBD instructions: 0x00000000 rdtsc 0x00000002 js 00007F88914C4376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700E73 second address: 700E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700E77 second address: 700E94 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F88914C4385h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700E94 second address: 700EAA instructions: 0x00000000 rdtsc 0x00000002 jo 00007F88914C0B06h 0x00000008 jmp 00007F88914C0B0Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700EAA second address: 700EC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C4384h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70100B second address: 701011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 701011 second address: 70101D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F88914C4376h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70101D second address: 70102A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F88914C0B08h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7069DB second address: 7069DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7069DF second address: 7069F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F88914C0B06h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706F5A second address: 706F5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 707786 second address: 70779A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C0B10h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70779A second address: 7077B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F88914C4384h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 707915 second address: 707954 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C0B10h 0x00000007 jmp 00007F88914C0B14h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebx 0x0000000f push esi 0x00000010 jmp 00007F88914C0B0Dh 0x00000015 jc 00007F88914C0B0Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 707D74 second address: 707D80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F88914C4376h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7066FD second address: 706701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706701 second address: 70670B instructions: 0x00000000 rdtsc 0x00000002 je 00007F88914C4376h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70670B second address: 706729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F88914C0B14h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71009E second address: 7100A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7100A8 second address: 7100AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7100AE second address: 7100E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C437Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007F88914C437Ah 0x00000013 pushad 0x00000014 jmp 00007F88914C4387h 0x00000019 push edi 0x0000001a pop edi 0x0000001b push edi 0x0000001c pop edi 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BF61 second address: 67BF7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F88914C0B14h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BF7E second address: 67BF98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C4384h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BF98 second address: 67BFB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C0B18h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BFB6 second address: 67BFBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70FD38 second address: 70FD3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70FD3E second address: 70FD75 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F88914C439Fh 0x00000008 jmp 00007F88914C4387h 0x0000000d jmp 00007F88914C4382h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713213 second address: 713217 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712AD7 second address: 712AE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F88914C4376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712C4C second address: 712C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F88914C0B06h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d jbe 00007F88914C0B1Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712C79 second address: 712CB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F88914C4381h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F88914C4382h 0x00000012 jmp 00007F88914C437Eh 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712CB5 second address: 712CBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712E31 second address: 712E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 jo 00007F88914C4376h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712E3F second address: 712E44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712E44 second address: 712E50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F88914C4376h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7181B2 second address: 7181D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F88914C0B14h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7175E2 second address: 7175E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71772C second address: 717732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717732 second address: 717765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F88914C4383h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 jng 00007F88914C437Eh 0x00000018 pushad 0x00000019 push esi 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717765 second address: 717789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F88914C0B1Ch 0x0000000e jmp 00007F88914C0B0Bh 0x00000013 jmp 00007F88914C0B0Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717789 second address: 71778F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71778F second address: 717793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717A3F second address: 717A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717A43 second address: 717A6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C0B19h 0x00000007 jnc 00007F88914C0B06h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717A6B second address: 717A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F88914C4376h 0x0000000a jmp 00007F88914C437Dh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717D3C second address: 717D52 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F88914C0B0Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717D52 second address: 717D66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F88914C437Ah 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71EF3E second address: 71EF42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71EF42 second address: 71EF80 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F88914C4376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b jbe 00007F88914C43B3h 0x00000011 jg 00007F88914C4399h 0x00000017 jmp 00007F88914C4386h 0x0000001c jmp 00007F88914C437Dh 0x00000021 push eax 0x00000022 push edx 0x00000023 push esi 0x00000024 pop esi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71EF80 second address: 71EF84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71EF84 second address: 71EF8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D77E second address: 71D782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D782 second address: 71D7DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C4380h 0x00000007 jmp 00007F88914C437Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F88914C4384h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jg 00007F88914C4376h 0x0000001d jmp 00007F88914C4383h 0x00000022 jg 00007F88914C4376h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71DF41 second address: 71DF5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F88914C0B17h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71DF5D second address: 71DF82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F88914C4376h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jc 00007F88914C43A0h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F88914C437Fh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CAFFF second address: 6CB00E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB00E second address: 6CB012 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB012 second address: 6CB018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB018 second address: 6CB01F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB01F second address: 6CB086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push esi 0x00000009 mov edi, dword ptr [ebp+122D24CDh] 0x0000000f pop edi 0x00000010 push 00000004h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F88914C0B08h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c push ebx 0x0000002d sub dword ptr [ebp+122D2AFEh], ebx 0x00000033 pop ecx 0x00000034 nop 0x00000035 pushad 0x00000036 pushad 0x00000037 pushad 0x00000038 popad 0x00000039 jmp 00007F88914C0B14h 0x0000003e popad 0x0000003f jc 00007F88914C0B08h 0x00000045 pushad 0x00000046 popad 0x00000047 popad 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c pushad 0x0000004d popad 0x0000004e pushad 0x0000004f popad 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E1B3 second address: 71E1F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F88914C437Fh 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F88914C437Ch 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jmp 00007F88914C4387h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E1F0 second address: 71E1F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722015 second address: 722030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F88914C4376h 0x0000000a jmp 00007F88914C4380h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 721D79 second address: 721D81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A43D second address: 72A47B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C4385h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F88914C4382h 0x0000000e jmp 00007F88914C4383h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 728661 second address: 728677 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F88914C0B0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F88914C0B06h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 728A81 second address: 728A9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 jmp 00007F88914C437Ah 0x0000000c jne 00007F88914C437Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 728D17 second address: 728D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jns 00007F88914C0B08h 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 jne 00007F88914C0B06h 0x0000001a pushad 0x0000001b popad 0x0000001c pop eax 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 js 00007F88914C0B06h 0x00000026 jmp 00007F88914C0B0Ah 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729015 second address: 72903D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jns 00007F88914C4376h 0x0000000e jmp 00007F88914C4389h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72903D second address: 729042 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729EC9 second address: 729F21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F88914C4387h 0x00000009 popad 0x0000000a pop esi 0x0000000b pushad 0x0000000c jmp 00007F88914C437Bh 0x00000011 jmp 00007F88914C4389h 0x00000016 pushad 0x00000017 jmp 00007F88914C4381h 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A196 second address: 72A19A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A19A second address: 72A1A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E479 second address: 72E47F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72DE53 second address: 72DE5D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F88914C4382h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72DE5D second address: 72DE63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C878 second address: 73C89D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C4386h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c js 00007F88914C4376h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73A9FA second address: 73AA0A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F88914C0B06h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73AB39 second address: 73AB4C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F88914C437Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B565 second address: 73B583 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F88914C0B18h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B583 second address: 73B587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B587 second address: 73B58B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B826 second address: 73B86B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C4388h 0x00000007 jnl 00007F88914C4376h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jnl 00007F88914C438Fh 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73A506 second address: 73A50C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73A50C second address: 73A520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a ja 00007F88914C4376h 0x00000010 pop edx 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73A520 second address: 73A536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F88914C0B11h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73A536 second address: 73A53B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74247F second address: 742483 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74FF4B second address: 74FF6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jnp 00007F88914C4376h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F88914C4384h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754833 second address: 754837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754837 second address: 75484D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F88914C437Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75484D second address: 754851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754851 second address: 754864 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jno 00007F88914C4376h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754864 second address: 754868 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68AE67 second address: 68AE71 instructions: 0x00000000 rdtsc 0x00000002 je 00007F88914C437Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75445D second address: 754461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7594F8 second address: 75952E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jmp 00007F88914C4388h 0x0000000a jmp 00007F88914C4384h 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769500 second address: 769515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F88914C0B0Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769515 second address: 769519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769519 second address: 76953C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F88914C0B0Ah 0x0000000f jmp 00007F88914C0B0Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76953C second address: 769548 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767EB8 second address: 767EBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 767EBE second address: 767EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7682A8 second address: 7682AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7682AE second address: 7682B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7682B4 second address: 7682E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F88914C0B0Fh 0x0000000a pop edi 0x0000000b push eax 0x0000000c push ecx 0x0000000d jno 00007F88914C0B06h 0x00000013 jmp 00007F88914C0B0Ch 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b je 00007F88914C0B06h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76AFB1 second address: 76AFB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E9D1 second address: 77E9D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E9D8 second address: 77E9DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E9DD second address: 77E9EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E9EC second address: 77EA1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F88914C4386h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f jg 00007F88914C4376h 0x00000015 pop esi 0x00000016 jbe 00007F88914C437Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AFC4 second address: 77AFC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AFC8 second address: 77AFCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DB34 second address: 78DB38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DB38 second address: 78DB3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DB3C second address: 78DB46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D939 second address: 78D93F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7905BB second address: 7905BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790759 second address: 790761 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790761 second address: 790766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9F88 second address: 7A9F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9F8E second address: 7A9F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F88914C0B06h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9F9B second address: 7A9FA9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F88914C4376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9FA9 second address: 7A9FAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA418 second address: 7AA42F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C437Eh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA42F second address: 7AA450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 je 00007F88914C0B27h 0x0000000b jmp 00007F88914C0B13h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAB0D second address: 7AAB13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAB13 second address: 7AAB2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F88914C0B13h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAB2F second address: 7AAB35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAB35 second address: 7AAB59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F88914C0B10h 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F88914C0B0Ah 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ADD76 second address: 7ADD8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F88914C4382h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ADD8D second address: 7ADD9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ADE10 second address: 7ADE57 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F88914C4376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D2367h], ecx 0x00000014 push 00000004h 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F88914C4378h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 call 00007F88914C4379h 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 pushad 0x00000039 popad 0x0000003a jc 00007F88914C4376h 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ADE57 second address: 7ADE98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C0B18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jns 00007F88914C0B1Bh 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ADE98 second address: 7ADEB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F88914C4382h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ADEB6 second address: 7ADEBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ADEBA second address: 7ADEE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c jng 00007F88914C4389h 0x00000012 jmp 00007F88914C4383h 0x00000017 push edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1213 second address: 7B1218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0DCA second address: 7B0DCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0DCE second address: 7B0DD8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F88914C0B0Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0DD8 second address: 7B0DEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F88914C437Ah 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0DEF second address: 7B0E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 jp 00007F88914C0B0Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0E04 second address: 7B0E10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F88914C4376h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0E10 second address: 7B0E14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70CEE second address: 4E70D32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F88914C437Ch 0x00000009 sbb cx, A4D8h 0x0000000e jmp 00007F88914C437Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 add eax, ecx 0x00000019 pushad 0x0000001a mov edx, ecx 0x0000001c mov edi, eax 0x0000001e popad 0x0000001f mov eax, dword ptr [eax+00000860h] 0x00000025 jmp 00007F88914C437Ah 0x0000002a test eax, eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70D32 second address: 4E70D4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C0B19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70D4F second address: 4E70D6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F88914C4381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F890224A371h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 mov dh, al 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70D6F second address: 4E70DC1 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F88914C0B0Fh 0x00000008 add si, 370Eh 0x0000000d jmp 00007F88914C0B19h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov ch, 4Ch 0x00000017 popad 0x00000018 test byte ptr [eax+04h], 00000005h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F88914C0B16h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4270 second address: 6C4276 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4276 second address: 6C427B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C441B second address: 6C4459 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F88914C437Ah 0x00000008 jne 00007F88914C4376h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F88914C4387h 0x0000001a jmp 00007F88914C437Ch 0x0000001f popad 0x00000020 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 523911 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6B95EE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 743E7F instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6112

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.1736439945.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1757176256.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1757353177.0000000000E7A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736486716.0000000000E7A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: file.exe, 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00505BB0 LdrInitializeThunk,

0_2_00505BB0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: spirittunek.stor
Source: file.exe	String found in binary or memory: bathdoomgaz.stor
Source: file.exe	String found in binary or memory: studennotediw.stor
Source: file.exe	String found in binary or memory: dissapoiznw.stor
Source: file.exe	String found in binary or memory: eaglepawnoy.stor
Source: file.exe	String found in binary or memory: mobbipenju.stor

Source: file.exe, file.exe, 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: UProgram Manager

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.ZPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
steamcommunity.com	0%	Virustotal	Browse
eaglepawnoy.store	1%	Virustotal	Browse
clearancek.site	1%	Virustotal	Browse
dissapoiznw.store	1%	Virustotal	Browse
licendfilteo.site	1%	Virustotal	Browse
studennotediw.store	1%	Virustotal	Browse
spirittunek.store	1%	Virustotal	Browse
bathdoomgaz.store	1%	Virustotal	Browse
mobbipenju.store	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://player.vimeo.com	0%	URL Reputation	safe
https://player.vimeo.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	0%	Virustotal		Browse
https://steamcommunity.com/my/wishlist/	0%	Virustotal		Browse
https://steamcommunity.com/?subsection=broadcasts	0%	Virustotal		Browse
https://steamcommunity.com/market/	0%	Virustotal		Browse
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	0%	Virustotal		Browse
https://steamcommunity.com/discussions/	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli	0%	Virustotal		Browse
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	0%	Virustotal		Browse
https://clearancek.site:443/api	14%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz	0%	Virustotal		Browse
https://www.youtube.com	0%	Virustotal		Browse
clearancek.site	1%	Virustotal		Browse
https://licendfilteo.site:443/api	12%	Virustotal		Browse
https://steamcommunity.com/workshop/	0%	Virustotal		Browse
https://studennotediw.store:443/api&	8%	Virustotal		Browse
https://eaglepawnoy.store:443/api	14%	Virustotal		Browse
https://steamcommunity.com	0%	Virustotal		Browse
licendfilteo.site	1%	Virustotal		Browse
https://steamcommunity.com:443/profiles/76561199724331900	8%	Virustotal		Browse
https://www.youtube.com/	0%	Virustotal		Browse
https://sketchfab.com	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R	0%	Virustotal		Browse
http://127.0.0.1:27060	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	104.102.49.254	true	false	0%, Virustotal, Browse	unknown
eaglepawnoy.store	unknown	unknown	false	1%, Virustotal, Browse	unknown
bathdoomgaz.store	unknown	unknown	false	1%, Virustotal, Browse	unknown
spirittunek.store	unknown	unknown	false	1%, Virustotal, Browse	unknown
licendfilteo.site	unknown	unknown	true	1%, Virustotal, Browse	unknown
studennotediw.store	unknown	unknown	false	1%, Virustotal, Browse	unknown
mobbipenju.store	unknown	unknown	false	1%, Virustotal, Browse	unknown
clearancek.site	unknown	unknown	true	1%, Virustotal, Browse	unknown
dissapoiznw.store	unknown	unknown	false	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
studennotediw.stor	true		unknown
spirittunek.stor	true		unknown
eaglepawnoy.stor	true		unknown
clearancek.site	true	1%, Virustotal, Browse	unknown
mobbipenju.stor	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
licendfilteo.site	true	1%, Virustotal, Browse	unknown
bathdoomgaz.stor	true		unknown
dissapoiznw.stor	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/my/wishlist/	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://player.vimeo.com	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	file.exe, 00000000.00000003.1736439945.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://steamcommunity.com/market/	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://store.steampowered.com/news/	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.1736486716.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000000.00000003.1736486716.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	file.exe, 00000000.00000002.1757176256.0000000000E35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.youtube.com	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://store.steampowered.com/stats/	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://medal.tv	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000000.00000003.1736486716.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000000.00000003.1736486716.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://clearancek.site:443/api	file.exe, 00000000.00000002.1757353177.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736486716.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	false	14%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz	file.exe, 00000000.00000002.1757176256.0000000000E35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://s.ytimg.com;	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://login.steampowered.com/	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://eaglepawnoy.store:443/api	file.exe, 00000000.00000002.1757353177.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736486716.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	false	14%, Virustotal, Browse	unknown
https://store.steampowered.com/legal/	file.exe, 00000000.00000003.1736486716.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steam.tv/	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://licendfilteo.site:443/api	file.exe, 00000000.00000002.1757353177.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736486716.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	false	12%, Virustotal, Browse	unknown
https://studennotediw.store:443/api&	file.exe, 00000000.00000002.1757353177.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736486716.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	false	8%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.1736486716.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com:443/profiles/76561199724331900	file.exe, 00000000.00000002.1757353177.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736486716.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	false	8%, Virustotal, Browse	unknown
https://store.steampowered.com/points/shop/	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com	file.exe, 00000000.00000003.1736486716.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://sketchfab.com	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://lv.queniujq.cn	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://127.0.0.1:27060	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	file.exe, 00000000.00000003.1736486716.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R	file.exe, 00000000.00000002.1757176256.0000000000E35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://clearancek.site:443/apiiY	file.exe, 00000000.00000002.1757353177.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736486716.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/account/cookiepreferences/	file.exe, 00000000.00000003.1736486716.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/mobile	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736486716.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	file.exe, 00000000.00000003.1736439945.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1757464983.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1736412307.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	file.exe, 00000000.00000003.1736412307.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527574
Start date and time:	2024-10-07 04:04:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@9/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:05:01	API Interceptor	2x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	http://buddycities.com/	Get hash	malicious	Unknown	Browse	104.102.49.254
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94954976566998
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'825'280 bytes
MD5:	c461a62ec008b2a001dfb3f58ba3cfaa
SHA1:	cff4b40928bd2e8f0c212e5a8fa7a3693d2ba7d3
SHA256:	aecc7f82d4dd048f1c05484ebd338e3d0738468729c61af73c39f2bce62cc7ea
SHA512:	0d05322dda23939a3dba5fa90f09d0c8be6c8771f43e5713f4f0ef9afaf332feaab769052e5baa410895f997c36005c19b214416e5b0228fb736c2dd1302ebeb
SSDEEP:	49152:aC7Ws6hknOcQCKRgXntEZx4TeAilXXW4bC:aNXcQChnt4eep/
TLSH:	C285335B0E6ADEBBCF2F0DB160E707A2E68051E523A0ED59341E7072A05318739A7D7D
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f............................. I...........@..........................PI......s....@.................................W...k..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x892000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F8890724A9Ah
popcnt ebx, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add eax, 0B00000Ah
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	15ea1be02066d40a7d624674febd2602	False	0.9995423370462047	data	7.981559310491324	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x60000	0x29c000	0x200	27003e444639dabf1bf47b4c7590a2ba	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
smlnkmvk	0x2fc000	0x195000	0x194200	b9521c076d627e548d71a5e710959f95	False	0.9944469146303743	data	7.953849137350641	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ameacfcj	0x491000	0x1000	0x400	db7744bd3b2fcd1133367b9f308dab86	False	0.7626953125	data	5.931225376837168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x492000	0x3000	0x2200	5d8e28a9ec2f13feacff15a5401d2030	False	0.09214154411764706	DOS executable (COM)	0.939900370754624	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T04:05:02.314150+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	61485	1.1.1.1	53	UDP
2024-10-07T04:05:02.353408+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	53457	1.1.1.1	53	UDP
2024-10-07T04:05:02.362870+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	50149	1.1.1.1	53	UDP
2024-10-07T04:05:02.373412+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	60448	1.1.1.1	53	UDP
2024-10-07T04:05:02.383260+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	57609	1.1.1.1	53	UDP
2024-10-07T04:05:02.394099+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	58160	1.1.1.1	53	UDP
2024-10-07T04:05:02.403281+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	59587	1.1.1.1	53	UDP
2024-10-07T04:05:02.414238+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	49221	1.1.1.1	53	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 04:05:02.437144995 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 04:05:02.437242985 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 04:05:02.437331915 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 04:05:02.457160950 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 04:05:02.457195997 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 04:05:03.312042952 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 04:05:03.312196016 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 04:05:03.345642090 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 04:05:03.345685005 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 04:05:03.346108913 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 04:05:03.391485929 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 04:05:03.662678957 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 04:05:03.707403898 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 04:05:04.061577082 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 04:05:04.061605930 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 04:05:04.061625004 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 04:05:04.061633110 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 04:05:04.061667919 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 04:05:04.061676979 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 04:05:04.061739922 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 04:05:04.061779976 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 04:05:04.061779976 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 04:05:04.061815023 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 04:05:04.151577950 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 04:05:04.151617050 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 04:05:04.151657104 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 04:05:04.151669025 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 04:05:04.151746035 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 04:05:04.154814005 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 04:05:04.154854059 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 04:05:04.154881001 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 04:05:04.154897928 CEST	443	49730	104.102.49.254	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 04:05:02.314150095 CEST	61485	53	192.168.2.4	1.1.1.1
Oct 7, 2024 04:05:02.322415113 CEST	53	61485	1.1.1.1	192.168.2.4
Oct 7, 2024 04:05:02.353408098 CEST	53457	53	192.168.2.4	1.1.1.1
Oct 7, 2024 04:05:02.361757040 CEST	53	53457	1.1.1.1	192.168.2.4
Oct 7, 2024 04:05:02.362869978 CEST	50149	53	192.168.2.4	1.1.1.1
Oct 7, 2024 04:05:02.371243954 CEST	53	50149	1.1.1.1	192.168.2.4
Oct 7, 2024 04:05:02.373411894 CEST	60448	53	192.168.2.4	1.1.1.1
Oct 7, 2024 04:05:02.382199049 CEST	53	60448	1.1.1.1	192.168.2.4
Oct 7, 2024 04:05:02.383260012 CEST	57609	53	192.168.2.4	1.1.1.1
Oct 7, 2024 04:05:02.391866922 CEST	53	57609	1.1.1.1	192.168.2.4
Oct 7, 2024 04:05:02.394098997 CEST	58160	53	192.168.2.4	1.1.1.1
Oct 7, 2024 04:05:02.402379036 CEST	53	58160	1.1.1.1	192.168.2.4
Oct 7, 2024 04:05:02.403280973 CEST	59587	53	192.168.2.4	1.1.1.1
Oct 7, 2024 04:05:02.412173986 CEST	53	59587	1.1.1.1	192.168.2.4
Oct 7, 2024 04:05:02.414237976 CEST	49221	53	192.168.2.4	1.1.1.1
Oct 7, 2024 04:05:02.422564983 CEST	53	49221	1.1.1.1	192.168.2.4
Oct 7, 2024 04:05:02.426465034 CEST	53455	53	192.168.2.4	1.1.1.1
Oct 7, 2024 04:05:02.433322906 CEST	53	53455	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 04:05:02.314150095 CEST	192.168.2.4	1.1.1.1	0x447b	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 04:05:02.353408098 CEST	192.168.2.4	1.1.1.1	0x84ad	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 04:05:02.362869978 CEST	192.168.2.4	1.1.1.1	0x53c	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 04:05:02.373411894 CEST	192.168.2.4	1.1.1.1	0xdeba	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 04:05:02.383260012 CEST	192.168.2.4	1.1.1.1	0x27b6	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 04:05:02.394098997 CEST	192.168.2.4	1.1.1.1	0x8755	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 04:05:02.403280973 CEST	192.168.2.4	1.1.1.1	0xe551	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 04:05:02.414237976 CEST	192.168.2.4	1.1.1.1	0xf932	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 04:05:02.426465034 CEST	192.168.2.4	1.1.1.1	0x6b3e	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 04:05:02.322415113 CEST	1.1.1.1	192.168.2.4	0x447b	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 04:05:02.361757040 CEST	1.1.1.1	192.168.2.4	0x84ad	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 04:05:02.371243954 CEST	1.1.1.1	192.168.2.4	0x53c	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 04:05:02.382199049 CEST	1.1.1.1	192.168.2.4	0xdeba	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 04:05:02.391866922 CEST	1.1.1.1	192.168.2.4	0x27b6	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 04:05:02.402379036 CEST	1.1.1.1	192.168.2.4	0x8755	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 04:05:02.412173986 CEST	1.1.1.1	192.168.2.4	0xe551	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 04:05:02.422564983 CEST	1.1.1.1	192.168.2.4	0xf932	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 04:05:02.433322906 CEST	1.1.1.1	192.168.2.4	0x6b3e	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.102.49.254	443	7052	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 02:05:03 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-07 02:05:04 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 07 Oct 2024 02:05:03 GMT Content-Length: 25489 Connection: close Set-Cookie: sessionid=80e320c054f52e6baceca204; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-07 02:05:04 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-07 02:05:04 UTC	10975	IN	Data Raw: 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 74 68 61 69 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 68 61 69 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e0 b9 84 e0 b8 97 e0 b8 a2 20 28 54 68 61 69 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 62 75 6c 67 61 72 69 61 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 62 75 6c 67 61 72 69 61 6e 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 Data Ascii: <a class="popup_menu_item tight" href="?l=thai" onclick="ChangeLanguage( 'thai' ); return false;"> (Thai)</a><a class="popup_menu_item tight" href="?l=bulgarian" onclick="ChangeLanguage( 'bulgarian' ); return fa

Target ID:	0
Start time:	22:05:00
Start date:	06/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x4c0000
File size:	1'825'280 bytes
MD5 hash:	C461A62EC008B2A001DFB3F58BA3CFAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	66.7%
Total number of Nodes:	45
Total number of Limit Nodes:	5

Executed Functions

Function 004CFCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

J|BJ, xrefs: 004D000D
t, xrefs: 004CFCBE
V, xrefs: 004CFEDC
VY^_, xrefs: 004CFDFF

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: 65f2ec7fad6fff34e60c7dab8a94f377ee0c540315a277e3b273908c43dfc6c9
Instruction ID: b47b45874d99ce7c79ce967efc9777004908b850b628bbd3ebacc491a77648eb
Opcode Fuzzy Hash: 65f2ec7fad6fff34e60c7dab8a94f377ee0c540315a277e3b273908c43dfc6c9
Instruction Fuzzy Hash: E1D1787450C3809BD311DF1495A4B6FBBE2AB92744F18881EF4C98B352C33ACD09DB9A

Function 004CD110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 004CD2F1

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 50c38e20b84bb36083705545a62cf44bdd060e5baa0c3fe81391dac1ef85a60e
Instruction ID: 8e365d08932c8bb70e2a5ecf8ac55ca4ec4441801cc5bcf921c9e92d664ccf99
Opcode Fuzzy Hash: 50c38e20b84bb36083705545a62cf44bdd060e5baa0c3fe81391dac1ef85a60e
Instruction Fuzzy Hash: 6841687880D380ABD341BB64D684E2EFBF5AF52709F048C6EE5C497252C339D8109B6B

Function 00505700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00505784

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 562ec115dec9b080a48a0722287f82d40f3cea6f4cc3ff993d13b922dc972cf0
Instruction ID: b6b5db42b2d8af675757cdcee285785f1f6d09c8e0f8f412725f5e537a136a9e
Opcode Fuzzy Hash: 562ec115dec9b080a48a0722287f82d40f3cea6f4cc3ff993d13b922dc972cf0
Instruction Fuzzy Hash: 1E11A07591C240EBD301AF28E854A1FBFF5EF9A710F058828E4C49B292D335D814DBA3

Function 00505BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0050973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00505BDE

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 0050695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 005069C5

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 6820ab6bb0bfeeaa423e471e4445a7ceb89cdcddface471f7eb0d5713e91d0a4
Instruction ID: 22d711e877694ed02e1a133ca8a32633046e0a08846102088f6650742c61af70
Opcode Fuzzy Hash: 6820ab6bb0bfeeaa423e471e4445a7ceb89cdcddface471f7eb0d5713e91d0a4
Instruction Fuzzy Hash: 443167B1A18301DFD718EF14C8A062EBBF2FF94344F48981CE5C6972A1E3749958CB56

Function 004D049B Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b27a19cc788bda83c32003f3a4c5d4d999d3d069c2edd64896271bc5c167d6
Instruction ID: 19c422a049da6796078cddc3f9e3fe370e71a3f11e8621a74fea49fd99a45478
Opcode Fuzzy Hash: 40b27a19cc788bda83c32003f3a4c5d4d999d3d069c2edd64896271bc5c167d6
Instruction Fuzzy Hash: DE918A75200B00CFD724CF25E8A4B1AB7F6FF89314F118A6DE8568BAA1D734E819DB50

Function 004D0228 Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20f7abeb73afb49d7cc8d144fbf6db374b7ae1195c715b2a70cad0fa4686c39
Instruction ID: ea9de99d15f68eea360a5b038f6aa6b68f5056ddfed905957f5fb364ad5f55ee
Opcode Fuzzy Hash: e20f7abeb73afb49d7cc8d144fbf6db374b7ae1195c715b2a70cad0fa4686c39
Instruction Fuzzy Hash: C0718B74200700DFD724CF20E8A8B2AB7F6FF59314F10896DE85687A62C735A819DF60

Function 005099D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1f42b20d2a4e6aadfa5be760774f18a7f220f79ba2aa6587282a1ba1650dfc5
Instruction ID: 9a9faf2ea7dfbee912221587574ba8b0ddab15f9f77c12c70102e3136dfd229b
Opcode Fuzzy Hash: c1f42b20d2a4e6aadfa5be760774f18a7f220f79ba2aa6587282a1ba1650dfc5
Instruction Fuzzy Hash: F7417C34208300ABD7149B15E891B2FFBA6FBC5764F54C82CE58A972D6D331E801DB62

Function 005063B8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 54db2315c4004fd9cab44e82aa4d7c90e8a0c38641afc4d1600e427461e8fe21
Instruction ID: 9315e89f397c1e3d8549bcaf2147246c9646f5cb14c6e9ffcee39a9a08453a7f
Opcode Fuzzy Hash: 54db2315c4004fd9cab44e82aa4d7c90e8a0c38641afc4d1600e427461e8fe21
Instruction Fuzzy Hash: 3F31D574649302BADA24DB04CD82F7FBBA5FB91B51FA4890CF1815B2E1D370B8259B52

Function 004D0EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97863fd99d825b8fea454b04134a21bf48d5d0f86f8ce5ae51cad88742742f0c
Instruction ID: 5e142a41744a8486893d5c328e7f9ebb686377b7f730e671023f409658395161
Opcode Fuzzy Hash: 97863fd99d825b8fea454b04134a21bf48d5d0f86f8ce5ae51cad88742742f0c
Instruction Fuzzy Hash: 86210CB490021A9FDB15CF94CCA0BBEBBB1FB4A304F24485AE511BB391C775A915CB64

Function 00503220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 005032A6

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 0b81799cbf2aa5df99c32075b4c47342cf804745e6194e051f30fbcdc9a0985a
Instruction ID: 4e9a673c1c76a3104f2f8a8e6dc39145c51bebefbe87ea63d0e5aade94950001
Opcode Fuzzy Hash: 0b81799cbf2aa5df99c32075b4c47342cf804745e6194e051f30fbcdc9a0985a
Instruction Fuzzy Hash: 0E014B3450D2409BC701AB18E859A1EBBE8EF5A701F058C1CE5C58B361D335DD64DBA6

Function 00503202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00503208

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 95ba27e9c6b3eb871f2e5f3f6f786c0ad0efe32e83e81647fb7e40b65fb3dfcb
Instruction ID: 5be2d2910b7cc78ebeb0095162edebd0900a965f85b21b72267f03e1e1099a7e
Opcode Fuzzy Hash: 95ba27e9c6b3eb871f2e5f3f6f786c0ad0efe32e83e81647fb7e40b65fb3dfcb
Instruction Fuzzy Hash: 3FB012300400006FDA041B00EC0AF003520EB10605F800050A500040F1D1655868D564

Non-executed Functions

Function 004DDB6F Relevance: 32.0, Strings: 24, Instructions: 2006COMMON

Download Yara Rule

Strings

|, xrefs: 004DECB1
@ONM, xrefs: 004DE6DB
T, xrefs: 004DF157
xgfe, xrefs: 004DE71D
WP, xrefs: 004DDCEF
DCBA, xrefs: 004DE887, 004DE896
89>?, xrefs: 004DE9F6
<=:;, xrefs: 004DE930
tsrq, xrefs: 004DE6FC
AR, xrefs: 004DDD10
`Y^_, xrefs: 004DE99E
dcba, xrefs: 004DE728
QNOL, xrefs: 004DE775
%*+(, xrefs: 004DDE37, 004DDE46
<=2, xrefs: 004DEA01
:WUE, xrefs: 004DF6B7, 004DF6C6
D, xrefs: 004DE846
mjkh, xrefs: 004DE7D8
tuJK, xrefs: 004DE967
lkji, xrefs: 004DE73E
()./, xrefs: 004DE9CA
89&', xrefs: 004DE93B
`onm, xrefs: 004DE733
LKJI, xrefs: 004DE6E6

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 2994545307-1418943773
Opcode ID: d7357e4fc546aa15bba2998b993228d2e9a3e80407de7cf1c7529a1b782e8331
Instruction ID: 7fe9aeb57b4d8b3b6b9f2b4dd4c34b8f5dc9e696453e93c40d7dda4b0efa58dd
Opcode Fuzzy Hash: d7357e4fc546aa15bba2998b993228d2e9a3e80407de7cf1c7529a1b782e8331
Instruction Fuzzy Hash: 89F288B05083819BD770DF15C8A4BABBBE6BFD5304F14482EE4C98B381D7799885CB96

Function 004F23E0 Relevance: 31.3, APIs: 4, Strings: 12, Instructions: 3298COMMON

Download Yara Rule

Strings

f@~!, xrefs: 004F25FF
Cx, xrefs: 004F453D
`tii, xrefs: 004F2693
%*+(, xrefs: 004F40EF
aenQ, xrefs: 004F276A
{l`~, xrefs: 004F268C
:, xrefs: 004F32DD
3<, xrefs: 004F32D6
ggxz, xrefs: 004F2685
mlc@, xrefs: 004F275C
fedc, xrefs: 004F2782
|}&C, xrefs: 004F2F21

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: %*+($3<$:$Cx$`tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~$|}&C
API String ID: 0-786070067
Opcode ID: 99643ac764a79f814e556bf218c76044080186c69dcc7fc2ae59a9f924653a7c
Instruction ID: 7a7e7a56a6f7e3f1d0d29d48e3d36980c693f07d1cf483392b817c6ae7a2c0ca
Opcode Fuzzy Hash: 99643ac764a79f814e556bf218c76044080186c69dcc7fc2ae59a9f924653a7c
Instruction Fuzzy Hash: C433DC70504B818FD7218F38C590B63BBE1BF56304F58899ED5DA8BB82C739E806CB65

Function 004E9F62 Relevance: 21.7, Strings: 17, Instructions: 473COMMON

Download Yara Rule

Strings

]{, xrefs: 004EA1E7, 004EA1F3
WH, xrefs: 004EAA1C
WQ, xrefs: 004EA62B
Gt, xrefs: 004E9FF8
(a*c, xrefs: 004EA147
N[, xrefs: 004EA375
=], xrefs: 004EA36A
sm, xrefs: 004EA830
CG, xrefs: 004EAA32
hi, xrefs: 004EAB9D
_Y, xrefs: 004EA641
JG, xrefs: 004EAA27
%e6g, xrefs: 004EA152
/), xrefs: 004EA66D
kW, xrefs: 004EA380
?m,o, xrefs: 004EA13C
S], xrefs: 004EA636

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: 294a862a89a28297ddcfa88a50001d66a44a33f1a96274d41f4f6ba78247088e
Instruction ID: 1ccfc0117439cedce69a4b4c7c00ac7671952ad0dd5606f17b1e3ff810d3a8a7
Opcode Fuzzy Hash: 294a862a89a28297ddcfa88a50001d66a44a33f1a96274d41f4f6ba78247088e
Instruction Fuzzy Hash: 8F52C7B840D385CAE270CF26D581B8EBAF1BB92740F608A1EE1ED5B255DB708045CF97

Function 004E9510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

z=Q?, xrefs: 004E9826
L3Y=, xrefs: 004E9B03
X/R), xrefs: 004E9AEB
pq, xrefs: 004E99E0
?M0K, xrefs: 004E9968
B?Q9, xrefs: 004E9B0B
B7U1, xrefs: 004E9AFB
;IJK, xrefs: 004E983E
2A"_, xrefs: 004E9980
G+X5, xrefs: 004E9AF3
O+f), xrefs: 004E9634, 004E963D
8;, xrefs: 004E9B13
!E4G, xrefs: 004E9836
G'M!, xrefs: 004E9ADB
T#a-, xrefs: 004E9AE3
,A&C, xrefs: 004E982E

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: 7a3779aaa9c1e1aa2b6659578d8071f32403b7fb63a570cea416a4c66b633ad4
Instruction ID: 4b482e09e04c48a6f4964e3bb6b0213f9a7b544d5e74b4f2771511e2d4166017
Opcode Fuzzy Hash: 7a3779aaa9c1e1aa2b6659578d8071f32403b7fb63a570cea416a4c66b633ad4
Instruction Fuzzy Hash: 4FF14FB4408380ABD310DF16D881A2BBBF4FB96749F144D1DF4D99B292D378D909CB9A

Function 004EDD29 Relevance: 18.6, Strings: 14, Instructions: 1142COMMON

Download Yara Rule

Strings

n\+H, xrefs: 004EDDC0
rN, xrefs: 004EE92E
%*+(, xrefs: 004EE143
=]+_, xrefs: 004EE276
N, xrefs: 004EE403, 004EE664, 004EE7BD
Y9N;, xrefs: 004EE245
-M2O, xrefs: 004EE25A
<Y.[, xrefs: 004EE27D
hX]N, xrefs: 004EDDC7
N, xrefs: 004EE9C5
,Q?S, xrefs: 004EE26F
upH}, xrefs: 004EDE8A, 004EE798, 004EDF4A
)IgK, xrefs: 004EE261
{E, xrefs: 004EE323

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: N$%*+($)IgK$,Q?S$-M2O$<Y.[$=]+_$Y9N;$hX]N$n\+H$rN$upH}${E$N
API String ID: 0-1504554227
Opcode ID: aa73bf064e219c965e0ef35f3dd7efca5fd7d9d53a1c23ef52fa32f44a96bc37
Instruction ID: ebb46d2c6cb45d3f5b4b68e8236918e595052a5a292fe92bc084fe9e049546f9
Opcode Fuzzy Hash: aa73bf064e219c965e0ef35f3dd7efca5fd7d9d53a1c23ef52fa32f44a96bc37
Instruction Fuzzy Hash: 54921371E00645CFDB04CF6AD8817AEBBB2FF49311F188169E516AB391D735AD02CB94

Function 0067C460 Relevance: 12.9, Strings: 9, Instructions: 1634COMMON

Download Yara Rule

Strings

GK=, xrefs: 0067D107
vMs, xrefs: 0067C5CA
vMs, xrefs: 0067C616
#.G, xrefs: 0067C477
{, xrefs: 0067CFDD
I[ S, xrefs: 0067CE06
cDm?, xrefs: 0067CE52
Z%q, xrefs: 0067C6B6
:2M-, xrefs: 0067CF42

Memory Dump Source

Source File: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: :2M-$GK=$I[ S$Z%q$cDm?$vMs$vMs$#.G${
API String ID: 0-1365006602
Opcode ID: e951631a7ed44a79d1a2621e52de93c0d8b771125149e63ec80f869149beca4a
Instruction ID: ede003270b4e7989c9d947643bdfad0668b91d578fb0fdf7becfc0a368e789fb
Opcode Fuzzy Hash: e951631a7ed44a79d1a2621e52de93c0d8b771125149e63ec80f869149beca4a
Instruction Fuzzy Hash: DCB2F7F360C204AFE3046E2DEC8567ABBE9EF94720F1A493DE6C4C7744E53598058697

Function 0067DE60 Relevance: 11.6, Strings: 8, Instructions: 1598COMMON

Download Yara Rule

Strings

6DT`, xrefs: 0067E865
Uw, xrefs: 0067E61E
W}x, xrefs: 0067F152
ZO*{, xrefs: 0067E5C7
W???, xrefs: 0067DF41
u;, xrefs: 0067E516
Aw, xrefs: 0067EE38
#Scz, xrefs: 0067F158

Memory Dump Source

Source File: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: #Scz$6DT`$Aw$Uw$W???$W}x$ZO*{$u;
API String ID: 0-2650110343
Opcode ID: 8d0160b933d1603529ec8da2492a4948174e7fe85ef7892772c5d0a628dcf784
Instruction ID: 193db0b100228c800f4a9f9d8210abab893f4c333daf36d287435fcc6b102b95
Opcode Fuzzy Hash: 8d0160b933d1603529ec8da2492a4948174e7fe85ef7892772c5d0a628dcf784
Instruction Fuzzy Hash: A5B2F5F360C2049FE304AE2DEC8567AF7E9EF94720F1A893DE6C4C7744EA3558058696

Function 004E098B Relevance: 10.8, Strings: 8, Instructions: 836COMMON

Download Yara Rule

Strings

gce/, xrefs: 004E1073
qrqp, xrefs: 004E1089
cah`, xrefs: 004E107E
9.5^, xrefs: 004E0F9F
{, xrefs: 004E1502
,#15, xrefs: 004E0F94
%*+(, xrefs: 004E0A77, 004E0A86
&> &, xrefs: 004E0F89

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: %*+($&> &$,#15$9.5^$cah`$gce/$qrqp${
API String ID: 0-4102007303
Opcode ID: 205c14eac75e95ce58efd479b69f6b35137042573e669207afb788a51e7007d6
Instruction ID: 6eeed0a68fc5dd9027a1056d4dc50a461011ca72ce04b9a6a09714bb468a7ff8
Opcode Fuzzy Hash: 205c14eac75e95ce58efd479b69f6b35137042573e669207afb788a51e7007d6
Instruction Fuzzy Hash: AE62BBB55083818BD330CF15C895BABB7E1FF96315F04492EE49A8B781E3798885CB57

Function 00686392 Relevance: 10.4, Strings: 7, Instructions: 1632COMMON

Download Yara Rule

Strings

5;w, xrefs: 006863BE
c!xe, xrefs: 00686BAE
$bA, xrefs: 0068703D
If], xrefs: 00686E4E
};, xrefs: 00686643
Ko~_, xrefs: 00686D2D
'w/, xrefs: 00686811

Memory Dump Source

Source File: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: $bA$'w/$Ko~_$c!xe$5;w$If]$};
API String ID: 0-3573816701
Opcode ID: 4a762f5b3ce0044ea71b1dc3449df03316b373da72d26b41ad2d23c8251d3088
Instruction ID: 89ca04e3cbcddc2c34150023d7a63cdee8a4107c9b20686cfd5c5b3f159390dc
Opcode Fuzzy Hash: 4a762f5b3ce0044ea71b1dc3449df03316b373da72d26b41ad2d23c8251d3088
Instruction Fuzzy Hash: 7FB218F3A0C2049FE304AE29EC8567AFBE9EF94320F16493DE6C5C3744E67598058792

Function 00682E2D Relevance: 9.1, Strings: 6, Instructions: 1601COMMON

Download Yara Rule

Strings

ht\, xrefs: 006838A1
'X^], xrefs: 006831C4
^SW, xrefs: 00683A56
6[U(, xrefs: 00682F9D
qN-+, xrefs: 00683B2E
BVX, xrefs: 006837C2

Memory Dump Source

Source File: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: 'X^]$6[U($BVX$^SW$ht\$qN-+
API String ID: 0-869149590
Opcode ID: be6de3823750e6ac357ec5cab005a4836cb1b50d533e0f58d65d8abbfceb41bd
Instruction ID: f055fc9b511525bf0aa3f2230842df7664d71a14b38be3809f87878f9bad8b2c
Opcode Fuzzy Hash: be6de3823750e6ac357ec5cab005a4836cb1b50d533e0f58d65d8abbfceb41bd
Instruction Fuzzy Hash: 1DB203F36082049FE704AE29EC8577ABBE9EF94320F1A493DE6C5C7740E63598058797

Function 00687EDB Relevance: 9.1, Strings: 6, Instructions: 1568COMMON

Download Yara Rule

Strings

%d{, xrefs: 00688E5F
b:, xrefs: 00688F42
I3{}, xrefs: 0068881A
Xv1, xrefs: 00688C81
!%OZ, xrefs: 0068910E
KC{y, xrefs: 00688124

Memory Dump Source

Source File: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: !%OZ$%d{$I3{}$KC{y$Xv1$b:
API String ID: 0-3026920307
Opcode ID: 147f0a427bc51d0f3cc5134d3d8edb381c61a1826b30d5b5520f17c18f7660dd
Instruction ID: 8e7e73d8de4a1c3cd0abe5844a1e284313f6fcf1ebf808bc29e4384a74749621
Opcode Fuzzy Hash: 147f0a427bc51d0f3cc5134d3d8edb381c61a1826b30d5b5520f17c18f7660dd
Instruction Fuzzy Hash: 59A2F7F360C2049FE304AE2DEC8567AFBE9EF94720F164A3DEAC4C7744E67558018696

Function 006899F1 Relevance: 7.8, Strings: 5, Instructions: 1521COMMON

Download Yara Rule

Strings

cf, xrefs: 0068A336
R3, xrefs: 0068A835
Pou, xrefs: 0068AB86
$DLo, xrefs: 0068A331
q#]|, xrefs: 0068A112

Memory Dump Source

Source File: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: $DLo$cf$q#]|$Pou$R3
API String ID: 0-1867875057
Opcode ID: f017e9b702c84c2a08bea6084f0359fa3df2c680588b7a2e05a602ea5598c532
Instruction ID: 3fc2810f8afc6e856ece669e10864ab1ef8ca66130d0f78380e830858295f16f
Opcode Fuzzy Hash: f017e9b702c84c2a08bea6084f0359fa3df2c680588b7a2e05a602ea5598c532
Instruction Fuzzy Hash: FAA209F360C6049FE304AE2DEC8567AB7E6EBD4320F16893DE6C4C3744EA3599058796

Function 004E2260 Relevance: 6.6, Strings: 5, Instructions: 383COMMON

Download Yara Rule

Strings

hu, xrefs: 004E232F
lc, xrefs: 004E2507
a|, xrefs: 004E2317
b&N, xrefs: 004E265C
sj, xrefs: 004E2327

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: a|$b&N$hu$lc$sj
API String ID: 0-2318642599
Opcode ID: d9ff79cc7887a897cf93899522a1db79d654570db4fea5a4001c6a29737da46c
Instruction ID: 03798248cd5a59550358ec391ed77c780183147f460c0e039c464d09c88a8759
Opcode Fuzzy Hash: d9ff79cc7887a897cf93899522a1db79d654570db4fea5a4001c6a29737da46c
Instruction Fuzzy Hash: 71A1BE704083818BC720DF19C991A2BB7F4FF95355F188A0DE8D59B391E3B9D941CB9A

Function 004EFD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

uvw, xrefs: 004EFE95
:, xrefs: 004F0087
NA_I, xrefs: 004F036D
m1s3, xrefs: 004EFEC3, 004EFECB

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: 63b538326f96e866b04d5594654316130d50bd5fea1ae7c6a516e0ae1ab49040
Instruction ID: 14c616f3bde93fa4ded80bd357c3d43bf7485202c1acf324ac33d887cfd2184b
Opcode Fuzzy Hash: 63b538326f96e866b04d5594654316130d50bd5fea1ae7c6a516e0ae1ab49040
Instruction Fuzzy Hash: C632BBB0508385DFD310DF29D880B2BBBE1AF96344F14895DF6D58B292D339D909CB9A

Function 004D3BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

;z, xrefs: 004D3C87
ss, xrefs: 004D3C79
%*+(, xrefs: 004D3EC4
p, xrefs: 004D3C80

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: 619f2e64054ade724da462e94034f694a1dbd5a23ffb8f280dda5aec7020ac9b
Instruction ID: db110cffb866503f9532716606848f03bfa2dec08c9674cfbe6008a77c1df301
Opcode Fuzzy Hash: 619f2e64054ade724da462e94034f694a1dbd5a23ffb8f280dda5aec7020ac9b
Instruction Fuzzy Hash: 77026AB4810B00EFD760DF25D996756BFB1FB01301F50895EE89A8B786E334A419CBA6

Function 0068B34A Relevance: 5.4, Strings: 3, Instructions: 1601COMMON

Download Yara Rule

Strings

>@oo, xrefs: 0068B3C5
hwwS, xrefs: 0068BCB5
I{N, xrefs: 0068B6A5

Memory Dump Source

Source File: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: >@oo$I{N$hwwS
API String ID: 0-2091500208
Opcode ID: c0f601e0a846f3ac65776a503b08af5bd302bcd5ca611f265f9f64538b947257
Instruction ID: 770a4550e81959bf82ebf46e825c2a387dccfb6af7047afaadc3bc0ad4bbfca8
Opcode Fuzzy Hash: c0f601e0a846f3ac65776a503b08af5bd302bcd5ca611f265f9f64538b947257
Instruction Fuzzy Hash: FDB2E6F3A0C2009FE318AE29EC8577ABBE9EF94720F1A453DE6C5C3744E63558058697

Function 0067F93A Relevance: 5.3, Strings: 3, Instructions: 1547COMMON

Download Yara Rule

Strings

\|s{, xrefs: 00680886
sE~Z, xrefs: 0067FFA0
Du{, xrefs: 006807D2

Memory Dump Source

Source File: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: \|s{$sE~Z$Du{
API String ID: 0-2967086225
Opcode ID: 1ae16f0f9f8a6f8bf410dfbe044578b540b2ded08e7e7757d272c6a836046258
Instruction ID: 4f47080b663dd8f39fb41b40dd5571ebecdc0a527d04ec667fd69da3b5263c8b
Opcode Fuzzy Hash: 1ae16f0f9f8a6f8bf410dfbe044578b540b2ded08e7e7757d272c6a836046258
Instruction Fuzzy Hash: C3B2D5F3A082049FE3046E29EC8567AFBE9EF94720F1A493DEAC5C3744E63558148797

Function 004ED7AF Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

T>, xrefs: 004ED984
#', xrefs: 004ED9EA
CV, xrefs: 004ED98B
KV, xrefs: 004ED97D

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: 71ffc916906ca152701f7e99c5d1d7524f738d4bc873055b9ca4ed8e6efe76fd
Instruction ID: 9df7067f7b17ce05cbd4a05c65f79b871b6aa28b77cf7af912470fd33a866a01
Opcode Fuzzy Hash: 71ffc916906ca152701f7e99c5d1d7524f738d4bc873055b9ca4ed8e6efe76fd
Instruction Fuzzy Hash: 108164F4801B499BCB20DF96D68516EBFB1BF12301F20460DE486ABB55C334AA55CFE6

Function 004EAC91 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

(g6e, xrefs: 004EACA1
4c2a, xrefs: 004EACA9
,{*y, xrefs: 004EAD07, 004EAD13
lk, xrefs: 004EACBC

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: 6f8a2735416ba6cb5143e36bff2de2f52f2db7df0f898ecdc487bbc4affbc1a2
Instruction ID: 1078153f8e0d34e5281ed4a19310c210e258497e8cef61c49b7f01ef56b7b13f
Opcode Fuzzy Hash: 6f8a2735416ba6cb5143e36bff2de2f52f2db7df0f898ecdc487bbc4affbc1a2
Instruction Fuzzy Hash: F7418874808381CBD7209F21D904BABB7F1FF86306F54995DE6C897250DB35D948CB9A

Function 004EC470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

%*+(, xrefs: 004EC9E4, 004EC9ED
%*+(, xrefs: 004EC8C3, 004EC8CB
~/i!, xrefs: 004EC537

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: bf64ccc5fb7c722b573d3a4236b98b139fc811b8cd9670a0834c2e4836ff3e92
Instruction ID: f6aac13df3d4e010f25c7d281c759941daf1e236447d449457b903cd7d974a06
Opcode Fuzzy Hash: bf64ccc5fb7c722b573d3a4236b98b139fc811b8cd9670a0834c2e4836ff3e92
Instruction Fuzzy Hash: 1FE1C8B1508380DFE3209F25D881B6FBBF5FB95341F44882DE2898B292D736D805CB96

Function 005E32B8 Relevance: 4.0, Strings: 3, Instructions: 229COMMON

Download Yara Rule

Strings

Zfk6, xrefs: 005E3498
Vfk6, xrefs: 005E3493
t'_?, xrefs: 005E32DC

Memory Dump Source

Source File: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: Vfk6$Zfk6$t'_?
API String ID: 0-3019639339
Opcode ID: 39fca4d6e3476a8946849ddb8038f11ac9f86ef07a1e091867b2f87ae7d28344
Instruction ID: da520ad1826507dfa396afa72befac31a0008347e9a2019bdd272c254db67f18
Opcode Fuzzy Hash: 39fca4d6e3476a8946849ddb8038f11ac9f86ef07a1e091867b2f87ae7d28344
Instruction Fuzzy Hash: 21610AF3A081009BF3046E2DED45B7BBBE5DBD8724F16453DE6C4C3780E93698158656

Function 00504040 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

f, xrefs: 0050420C
%*+(, xrefs: 005040A4, 005040AD

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: bc8a2a10fc3a83118a0225461fd07f57b8514e904fd6846d8f2d6f94369b74a3
Instruction ID: 522bd22b6363c667a4ba4ad17917c6160ec29dc5b3ca900651791b754cbec4bb
Opcode Fuzzy Hash: bc8a2a10fc3a83118a0225461fd07f57b8514e904fd6846d8f2d6f94369b74a3
Instruction Fuzzy Hash: 8C127BB16083419FC715CF18C880A2EBBE6FBC9314F588A2CEA959B291D735D945CF92

Function 004FF620 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

dg, xrefs: 004FF7F5
hi, xrefs: 004FF6E6

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: dg$hi
API String ID: 0-2859417413
Opcode ID: 0d57e12eccdee0d51af6bfbde7f9e6abd15579bc78e8c257aefa692ae1831292
Instruction ID: 35ccda6400de649e4654eb09c668d2c387f876ccf91538c2668123109160d4e1
Opcode Fuzzy Hash: 0d57e12eccdee0d51af6bfbde7f9e6abd15579bc78e8c257aefa692ae1831292
Instruction Fuzzy Hash: C4F18471618301EFE304DF24D891B6ABBE6FF96344F14892DF1858B2A1C739D94ACB16

Function 004C35B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

NaN, xrefs: 004C360E
Inf, xrefs: 004C3607

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: dbfe89dca792e76f0551072414134e213bacddbb156bb2b1d57ef7a7ec839092
Instruction ID: babae73e8e58fd30c2c29cb68e5ce8e7cda1a7bba72178521de9dc17c0b96f04
Opcode Fuzzy Hash: dbfe89dca792e76f0551072414134e213bacddbb156bb2b1d57ef7a7ec839092
Instruction Fuzzy Hash: 2AD1E4B5A083119BC754CF29C880A1FB7E1EBC8750F14C92EF999973A0E675DD058B86

Function 004DFFDF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

Ye[g, xrefs: 004E00F6
BaBc, xrefs: 004E0197

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: 654fec64a008f384f5e62c8361f7e110fe9b938e3baeaf978f0caa741601035b
Instruction ID: e191e41856937833c75a0f28e3c881e9b47517a8cc5a7aa8a1a3e2d2180028b7
Opcode Fuzzy Hash: 654fec64a008f384f5e62c8361f7e110fe9b938e3baeaf978f0caa741601035b
Instruction Fuzzy Hash: 8651BD716083818BC731CF56C481BABB7E0FF96315F08491EE4E98B651E3B89980CB5B

Function 005F072B Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

#as^, xrefs: 005F0786
#_, xrefs: 005F0757

Memory Dump Source

Source File: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: #_$#as^
API String ID: 0-2581402438
Opcode ID: 480d704d368c83184b2ebb6d3474361c955dd319cb9740bc650ede33fc8d0bf4
Instruction ID: b82feb13bb8b71208de41636219863551e215bd46807356139763c5d85de6a02
Opcode Fuzzy Hash: 480d704d368c83184b2ebb6d3474361c955dd319cb9740bc650ede33fc8d0bf4
Instruction Fuzzy Hash: 194122F3B182005BF34C9D39ED9973666DAD7D4320F2A863DEA85CB7C9E83988054249

Function 004C5160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 004C54C8

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: a948873b259c1fc335ffec0fc9a025ccff1436c0690efdc20226c8191723b768
Instruction ID: 2ae0b04b7734dd1ca1b87f3ce3477892cc1ea7146a40f6c18bacada42656efc6
Opcode Fuzzy Hash: a948873b259c1fc335ffec0fc9a025ccff1436c0690efdc20226c8191723b768
Instruction Fuzzy Hash: 342225B9A09B418BE7558E18C440B2FBBA2AFE0304F1C856ED8594B351E779FCC5C74A

Function 004F12D0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 004F15D1

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: dbbb96b422f2aa5677ee6a491e0af5f086089a27e796420f47b0110e099e943c
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: D3F15871A083498FD724CE25C490B3BBBE5AFC1354F08C56EE999873A2D639DC05C79A

Function 004EAE57 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

%*+(, xrefs: 004EB2D3, 004EB2DB

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 650f5e0dd06ac1d7b3de58bc8f9cdb696f935d2f7efc93cd0ebeffdd2b6f5df1
Instruction ID: f2ba5c1d45792b7a4bf2fb11914d621d71c43ad2c1b29e458e3a79717e1890df
Opcode Fuzzy Hash: 650f5e0dd06ac1d7b3de58bc8f9cdb696f935d2f7efc93cd0ebeffdd2b6f5df1
Instruction Fuzzy Hash: B6E1BA71508346CBC314DF2AC49056FB3F2FFA8792F54891DE9C587260E338AA59DB86

Function 004D6EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 004D6EF3

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: d94c3bdd0d8e13e0a9a3dde2ee4119912485b11a8bbfe908f91936f5d6ca26b1
Instruction ID: 9fbb6ec9b8338a9d0b68eb33e03eb2f8f0e11a8ee2bc9605ffcabb6b8793e985
Opcode Fuzzy Hash: d94c3bdd0d8e13e0a9a3dde2ee4119912485b11a8bbfe908f91936f5d6ca26b1
Instruction Fuzzy Hash: 7EF1BEB5A00A01CFD724DF25D891A26B3F2FF98314B158A2ED48787B91EB39F815CB44

Function 004E7E60 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 004E8263, 004E826B

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 6b5a66d50a5f4671d4294dce5b45f08b843f8c18fdd233dd1684fc8e4bd75120
Instruction ID: 00e03468baee27d84b89c5e264e6b923f10b9af3811e896ae452b7b76f9640bb
Opcode Fuzzy Hash: 6b5a66d50a5f4671d4294dce5b45f08b843f8c18fdd233dd1684fc8e4bd75120
Instruction Fuzzy Hash: 28C1D271508240ABDB10EB16C881A2BB7F5EF95355F08881EF8C997391E739DD05CB6B

Function 004E8D62 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

%*+(, xrefs: 004E9233, 004E923B

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: da5ff599f0b1cca3eb104fa71f646ea98467c3c32de13bc83795dfe4b1a9a5e6
Instruction ID: 9e49b76153ec12822ac255204ecdac4a63fb2e594df12b713224ef34baaa58be
Opcode Fuzzy Hash: da5ff599f0b1cca3eb104fa71f646ea98467c3c32de13bc83795dfe4b1a9a5e6
Instruction Fuzzy Hash: A8D10D70608342DFDB04DF69EC81A6AB7E6FF99301F48886DE88687391D774E884CB51

Function 004D4487 Relevance: 1.6, Strings: 1, Instructions: 389COMMON

Download Yara Rule

Strings

BIM, xrefs: 004D485E

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: BIM
API String ID: 0-2777237981
Opcode ID: f09c4c0393b3a3f908635c1e3438181e6022f8b164694a42fdce9adf83176611
Instruction ID: e0999a55bb57af2800f416f4884b1b45bf2b1a98d9200337927169e9f0d300ab
Opcode Fuzzy Hash: f09c4c0393b3a3f908635c1e3438181e6022f8b164694a42fdce9adf83176611
Instruction Fuzzy Hash: 5DE1E0B5501B008FD365CF28D9A2B97B7E1FF46708F04886EE4AA87B52E735B814CB54

Function 00507FC0 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 00508167

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: c7ce00e35cbeecc0b1a8f40f808632724b5405768b1cb9ebeb7f52f209556648
Instruction ID: 89e4d30f0463c96095ddff7ae5247ec4ad7fdd84e5df0a2a6122a55da913b153
Opcode Fuzzy Hash: c7ce00e35cbeecc0b1a8f40f808632724b5405768b1cb9ebeb7f52f209556648
Instruction Fuzzy Hash: 18D1C4729082658FC725CE18D890B6EBAE1FBC5758F158A2CE8A5AB3C0DB71DC05C7D1

Function 00506CBF Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

"pP, xrefs: 00507015

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: "pP
API String ID: 0-2161927070
Opcode ID: 073cfb988850aa8557caef602a03a5a040005e18361b479405b6ed70bfdb03ec
Instruction ID: 374208ccfbec209afc693d9c777bb27b2394a8f83bb23c38d603ebeed825eea4
Opcode Fuzzy Hash: 073cfb988850aa8557caef602a03a5a040005e18361b479405b6ed70bfdb03ec
Instruction Fuzzy Hash: EBD1EE36618355CFC710CF38D89056ABBE2BF99318F098A6CE895C73A1D335DA48DB91

Function 004ECCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 004ECDC3, 004ECDCB

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: ea39e60b9dfea3906dc196ab07b8cc98bad50d5e5cd3e0704be16542e4d55957
Instruction ID: d97ef73c7b3ee1d7026ec3e0203119a50edbe5ef1e24fd0da492c7969dcfeb51
Opcode Fuzzy Hash: ea39e60b9dfea3906dc196ab07b8cc98bad50d5e5cd3e0704be16542e4d55957
Instruction Fuzzy Hash: C6B124709083818BD714DF1AD881B3BBBE2EF95346F14482EE5C587391E339D816CB9A

Function 004FFC20 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

%*+(, xrefs: 004FFCA4, 004FFCAD

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: ebb2147efe786bf3438ac9353d04f2406d57e7cc604776d469f908fba07c8d15
Instruction ID: 8c6f7349cffa4fb7a59b8477394b448ffe69b5d46d401aa5a2ba7cf30717efe2
Opcode Fuzzy Hash: ebb2147efe786bf3438ac9353d04f2406d57e7cc604776d469f908fba07c8d15
Instruction Fuzzy Hash: A081DC71208305EBD710DF58D889A2FBBE5FF99741F04882DF28587291E735D819DB62

Function 0057169E Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

2P6, xrefs: 00571994

Memory Dump Source

Source File: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: 2P6
API String ID: 0-2041706565
Opcode ID: b08a3876535b0a9f62cfd3621bf17385ebe4e726ba4cb55b71646ab86062fba7
Instruction ID: f1227afbbc1ef2a64aa748ce52d28070f0cdc58f02748c194b95ff31d24b3d78
Opcode Fuzzy Hash: b08a3876535b0a9f62cfd3621bf17385ebe4e726ba4cb55b71646ab86062fba7
Instruction Fuzzy Hash: FE8117F3E082009BF3086E29ED5577ABBD6EBD4324F2A453DD7C5837C4E93A48158646

Function 004DD457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 004DD663, 004DD66B

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: abf8382050f06b6cd9d3d81692df2fba0ee852f70715bee95e96ab31c098409e
Instruction ID: 80e7310fd9b445755f05c9781a8cbfc9a42a1a1ede06f244c96304091ea1bd53
Opcode Fuzzy Hash: abf8382050f06b6cd9d3d81692df2fba0ee852f70715bee95e96ab31c098409e
Instruction Fuzzy Hash: DA610371904200EBD710EF18DCA2A6B73B0FF95354F04492EF88987391E379E915C796

Function 00504A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00504C33, 00504C3B

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 0a32417090feef947dc6bf7908f3e6d468df7dbfb4d4ef0ead924911148d4b42
Instruction ID: 7aa4959acf418abacc8da05fc9a2be32dc9ae97697536a6b345dcfd543c53d3b
Opcode Fuzzy Hash: 0a32417090feef947dc6bf7908f3e6d468df7dbfb4d4ef0ead924911148d4b42
Instruction Fuzzy Hash: F161BBB16083419BEB119F25C880B2EBBE6FBD4314F58891CEA85872D1D671EC54DF92

Function 005411A4 Relevance: 1.4, Strings: 1, Instructions: 194COMMON

Download Yara Rule

Strings

~+~>, xrefs: 00541264

Memory Dump Source

Source File: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: ~+~>
API String ID: 0-3999393889
Opcode ID: 6149def8d5e505fb1712f856859bd6cc0dc38f7406b32dd11f562f9903972084
Instruction ID: c8356ef1757f44638af3c9fc25cb1d18b126e90fd1f647baa3688c1e40805418
Opcode Fuzzy Hash: 6149def8d5e505fb1712f856859bd6cc0dc38f7406b32dd11f562f9903972084
Instruction Fuzzy Hash: E8511AF3E085144FF3085D2DDC8436AB6D6D7C4330F2B463DEA9993784D9795C068286

Function 004CE1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 004CE333

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: c5df1f904ce0d195681b9c71a1504f2efe0012e3f2707995e453517292ac44ff
Instruction ID: 7d19ac03a737e26c09da886896d7faa259daa142d2a468907abb866b3530c106
Opcode Fuzzy Hash: c5df1f904ce0d195681b9c71a1504f2efe0012e3f2707995e453517292ac44ff
Instruction Fuzzy Hash: 9A512837A1969047D364893E4C5176A6E870FA3334B2DC3AFE9B18B3E1D61988065355

Function 00503920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 005039E3, 005039EB

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 758dac1efa1ce5b7c70fde3427e6979549644d09b5bdd23681308d44b95f9ffb
Instruction ID: 1a312f7f3d3a48e9b2850e7b57d9364d71232a70cc2aa2554aba4aead0b87c4a
Opcode Fuzzy Hash: 758dac1efa1ce5b7c70fde3427e6979549644d09b5bdd23681308d44b95f9ffb
Instruction Fuzzy Hash: 12518934609200DBCB24DF59D985A2EBFEAFBC5744F18881CE4C687292D371DE14DB62

Function 004D1BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 004D1C3E

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: 33fef722fb185128035277fbca398eab55fbbb67ad394749d8bfda8c6e6cf429
Instruction ID: d8fd1b51f51852ad0f2ab457a62972db4bd1391200fb5c49988f5e3df9561bc6
Opcode Fuzzy Hash: 33fef722fb185128035277fbca398eab55fbbb67ad394749d8bfda8c6e6cf429
Instruction Fuzzy Hash: 144163B4018380ABC7149F54C8A4A6FBBF0BF96714F04990EF9C59B3A0D73AC905CB5A

Function 004FFF70 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00500033, 0050003B

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 6da8e24d3fcd5262f80ec5d7b69764f389bb789eb849230101ca3cca9ef22db9
Instruction ID: fb0f65bb5140d784c863e7aea44c259e82f590206324a9a76b201b16d97fc443
Opcode Fuzzy Hash: 6da8e24d3fcd5262f80ec5d7b69764f389bb789eb849230101ca3cca9ef22db9
Instruction Fuzzy Hash: F831F6B5A04305ABD610EB14DC99F2FBBE9FB85744F945829F885872D2E232DC14C7A3

Function 004EE40C Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

72?1, xrefs: 004EE6A2

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 42c486b4f9192bf3ddaefdbd2e801d0c3591a12bddb5103c7c397fc87f970b74
Instruction ID: ff340a396c139d68b48c7ed13c559195ef460fb41d73267f840fc23cd6be91bf
Opcode Fuzzy Hash: 42c486b4f9192bf3ddaefdbd2e801d0c3591a12bddb5103c7c397fc87f970b74
Instruction Fuzzy Hash: F9312BB5900645CFC720DF97D8806AFB7B5FB16305F14486EE546AB301D339AD05CBAA

Function 004D6F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 004D703B

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: fab36735e8382afe6d0239987cb3872274c44b6f92941bb7fdcb7c8ee029e62d
Instruction ID: 4434d71a91262904afbd0b2875a47c4200ac419b67793a4efb618202318ff174
Opcode Fuzzy Hash: fab36735e8382afe6d0239987cb3872274c44b6f92941bb7fdcb7c8ee029e62d
Instruction Fuzzy Hash: 65416771205B04DBD7358F61C9A5B27B7F2FB49704F54881EE5869BBA1E335F8008B54

Function 00759215 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

28(, xrefs: 00759285

Memory Dump Source

Source File: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: 28(
API String ID: 0-1973374224
Opcode ID: 8ac0aa7602ad0b9d8a7b54d33c7d39b5a67e6ee421a622c1cee8d20b54684a09
Instruction ID: c06b2a3f31d97a06c9da9ebd208d8498ff53859f4eaf85fe6e4d816515bfd731
Opcode Fuzzy Hash: 8ac0aa7602ad0b9d8a7b54d33c7d39b5a67e6ee421a622c1cee8d20b54684a09
Instruction Fuzzy Hash: 1331F2B250C304EFD341AE29D886AAAFBE9EF58760F164C2DE2C4C2610D73198818B47

Function 004EE66A Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

72?1, xrefs: 004EE6A2

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: eefa592fc5499caaaf7675ea4bcd013fd6032282478cb172be49c312b76efa09
Instruction ID: 69bd659b098c79243ef5a5980cdfe752e059cfc65ae96d4abffd1658c47bb354
Opcode Fuzzy Hash: eefa592fc5499caaaf7675ea4bcd013fd6032282478cb172be49c312b76efa09
Instruction Fuzzy Hash: 992102B5900645CFC720DF97D880AAFBBB5BB1A305F14486DE546AB301C339AD05CBAA

Function 00509CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00509D30

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 4e49087c5f863875731d78036a88cb67d4508f2e031ff5129240de43a7fb4354
Instruction ID: 2fa334b2e7086e491145b113b5aefafff06159d04be3146e825fe898b0689e14
Opcode Fuzzy Hash: 4e49087c5f863875731d78036a88cb67d4508f2e031ff5129240de43a7fb4354
Instruction Fuzzy Hash: 4B3154715083009BD310EF14D880A2EFBF9FB9A354F54892CE58597292E335D904CBA6

Function 004D4E2A Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e9a9cb896545dc4084d3268556b05edc30d4b2b8bb4886387d21927879c8e0
Instruction ID: 60422ec261f034c6e6da5ba0333b360da2ecca39fd1e0a2ead1850fef1f1ba25
Opcode Fuzzy Hash: 27e9a9cb896545dc4084d3268556b05edc30d4b2b8bb4886387d21927879c8e0
Instruction Fuzzy Hash: 076279B4500B009FD725CF24D9A0B27B7F5AF56304F54892ED49A87B52EB39F808CB99

Function 004CBEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction ID: 6d8beaed96e6c72e1e3721cab663cd7a5faf9cd77a213d3d0b38d7005e76f14e
Opcode Fuzzy Hash: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction Fuzzy Hash: 6352EA359087118BC7659F18D4807BBB3E1FFD5319F198A2ED9CA93390D738A851CB8A

Function 00508652 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8398bd7cab5f7f26715fcfa94b3636585783d5fc526bb7d07b15d527cad0ff
Instruction ID: d93ea163323a114d7790f2ac9ac668e86983792353304556179dc232a98399f8
Opcode Fuzzy Hash: 4a8398bd7cab5f7f26715fcfa94b3636585783d5fc526bb7d07b15d527cad0ff
Instruction Fuzzy Hash: 1F22CB35608341DFC704DF68E89066EBBE1FBA9315F09886DE58987392C735D898DF42

Function 005086F0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 115ac152cb06120fbcd99e3fa8b84fdb69a4119739de7ad9e555d4d3a6d3fa5c
Instruction ID: 4945a6954034fbe9ea53bccc367d00c1e65af7b15286175c54f15d8911790fd4
Opcode Fuzzy Hash: 115ac152cb06120fbcd99e3fa8b84fdb69a4119739de7ad9e555d4d3a6d3fa5c
Instruction Fuzzy Hash: 2C229835608341DFC704DF68E890A6EBBE1FB9A305F09896DE58987392C735E894DF42

Function 004CB3A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d11ee8662fab3e4c5aecb866ca5c453ec308acd60d60de649783ac9a358dbfa
Instruction ID: 3ec08b57d151d82c94f949341d04cf5de6ce859f59e4a49535423a44b9551879
Opcode Fuzzy Hash: 7d11ee8662fab3e4c5aecb866ca5c453ec308acd60d60de649783ac9a358dbfa
Instruction Fuzzy Hash: 6552D474908B849FE775CB24C086BA7BBE1EF91314F144C2EC5E606B82C77DA885C799

Function 004C71F0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81ad6a6aad964008996e1718bca11a2f9a4e720604067743ed9345d8966b5df
Instruction ID: b8f4cd56aaf4c200a72a5a4e145a788f1976e726be7dc898d6ce36769b704744
Opcode Fuzzy Hash: a81ad6a6aad964008996e1718bca11a2f9a4e720604067743ed9345d8966b5df
Instruction Fuzzy Hash: AC52E13950C3458FCB54CF28C080BAABBE1BF89314F188A6EE89957351D738E949CF85

Function 004C8FD0 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb1d803571eee692706581179f0a4cadcf097f83ba7d70f9d52c91947d608d72
Instruction ID: bfbd8963e402a86bc0eddb569dae7024b123c3d80f7958cde30dc04f57b373b5
Opcode Fuzzy Hash: bb1d803571eee692706581179f0a4cadcf097f83ba7d70f9d52c91947d608d72
Instruction Fuzzy Hash: 95427579608301DFD708CF28D855BAABBE1BB88314F198C6DE4858B391D339D989DF42

Function 004C7BF0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ef55272c434abbad1679021b4cd2a2fd4eeb2fc9863cc5479b26f3282f49a4
Instruction ID: 56fc25d9a1fcb1eb23f9cb787a7c75e4a7c7ebe2911295d199292af3dfff5dc8
Opcode Fuzzy Hash: e1ef55272c434abbad1679021b4cd2a2fd4eeb2fc9863cc5479b26f3282f49a4
Instruction Fuzzy Hash: 92322478514B118FC3B8CF29C690A26BBF1BF45710B644A2ED69787B90D73AF845CB18

Function 005089A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eeb9dfcc5b9d596c241100e4709080dc7bb70375cedc21dbb6295e5cc141a70
Instruction ID: 4700626f2f3c49603cb9f5f09c669b854388788af913d11602247743e001e26f
Opcode Fuzzy Hash: 1eeb9dfcc5b9d596c241100e4709080dc7bb70375cedc21dbb6295e5cc141a70
Instruction Fuzzy Hash: 5202A935608341DFC704DF68E890A2EBBE1FB9A305F09896DE4D5872A2C336D854DF92

Function 00508A80 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed3d19e510b408482ff7a2e454367e944dfb4b4e4693cde90aa5efd4e7fa817
Instruction ID: c72d2433d2a0d7085065321c542cc6aba7da51937e461f0f9fe35e4b3c947d1e
Opcode Fuzzy Hash: 8ed3d19e510b408482ff7a2e454367e944dfb4b4e4693cde90aa5efd4e7fa817
Instruction Fuzzy Hash: 5FF18935608381DFC704DF28E890A2EFBE1BB9A305F098D6DE4D587292D736D954CB92

Function 00508C02 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6ddd4c690324472a674848d8444c5b9ff084152201764495da51560a89c015
Instruction ID: 15ae4979f448b87cbc90d796a7aa9398d7d454d17635274398d1029339b60fe0
Opcode Fuzzy Hash: 5b6ddd4c690324472a674848d8444c5b9ff084152201764495da51560a89c015
Instruction Fuzzy Hash: ECE1AC35608341CFC704DF28E89066EBBE1BB9A315F09896CE4D987392D736E954CB92

Function 004CA300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: 239ef65253b8433b1a0651a5fa21dc5178da3eede5a907851ebdda8dda35ddee
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: FCF1BE796083458FC724CF29C881B6BFBE2AFD9304F08882DE4C987751E639E955CB56

Function 00508E70 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066c7af168e489b4771990762483e1452fb487270d47aca974aa6402c277ec51
Instruction ID: ae27346936518e01092d02a7329b2e2a335a99c9fe1e3ee6055901ac795d023a
Opcode Fuzzy Hash: 066c7af168e489b4771990762483e1452fb487270d47aca974aa6402c277ec51
Instruction Fuzzy Hash: 5BD1983460C281DFD704EF28D890A2EFBE5BB9A305F098D6CE4D587292D736D854DB92

Function 00507AB0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a08b8ff0660860b5d153315b2d15646312d0d04e162a5898aa0a5be754d591
Instruction ID: 3031a55933c57f185ca9affb8f46172d63e3a89ac3b9588a14f4ec3b5eac7bec
Opcode Fuzzy Hash: 39a08b8ff0660860b5d153315b2d15646312d0d04e162a5898aa0a5be754d591
Instruction Fuzzy Hash: 2BB12372E083544BE714DA28CC45B6FBBE9FBC9314F08492DE999973C2E635EC058792

Function 004CAF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: 34aa4937e0b3b59936a16c9e9f79f3b86159bf70858595e3c4e4470ca07cb2d8
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: 94C159B6A087418FC360CF68DC96BABB7E1EB85318F08492DD1D9C6342E778A155CB46

Function 004D6536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cba48e86b8a88e24e0f6929cdd0b3ffb20721e28bddc4a127d77a82cf61e2ac
Instruction ID: cd4da39263d8b67e1a47ab5e80c380b34ed7c025d04ff0b57dc44575e594167d
Opcode Fuzzy Hash: 4cba48e86b8a88e24e0f6929cdd0b3ffb20721e28bddc4a127d77a82cf61e2ac
Instruction Fuzzy Hash: 8BB10474500B409FD321CF24DAA1B17BBF1AF46704F14885EE8AA8BB52E739F805CB59

Function 00507710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0c990d36f8ff1f55442db31bc48b75ad2cf3b96a941e6caf5db47d4c4b2cd223
Instruction ID: d9e7d01223c0f7bef3600c30c5473314226574a3e52c2618b2d0efb6e0695275
Opcode Fuzzy Hash: 0c990d36f8ff1f55442db31bc48b75ad2cf3b96a941e6caf5db47d4c4b2cd223
Instruction Fuzzy Hash: 00917C71A08305ABE720DB14C845BAFBBE5FB89354F54881CF985973D2E730E944DB92

Function 0050A0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fade16e413cd3cd162b19266f6869b1c4edcd6a9454e70ab655b1161020d994d
Instruction ID: 3be19902382cd43e072296b74e3d8f9b7b3f246943593fb375900a0fd6abdfca
Opcode Fuzzy Hash: fade16e413cd3cd162b19266f6869b1c4edcd6a9454e70ab655b1161020d994d
Instruction Fuzzy Hash: DC817E342087029BD725DF28D880A6FBBF5FF99740F55892CE5868B291E731EC51CB92

Function 004F64F0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af8798d736f73787c3abea37a6b3a06d0e080bbb3fa522ada93e7431b1f076d0
Instruction ID: be485da384c5acb8e8ee4db32db77ad96b71eb429c622e9209e85a6d095dbdf5
Opcode Fuzzy Hash: af8798d736f73787c3abea37a6b3a06d0e080bbb3fa522ada93e7431b1f076d0
Instruction Fuzzy Hash: 93711733B29A944BD3149D7C5C423A6AA834BE7334B3EC37AEAB4CB3E5D52D48065345

Function 004E28E9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195b6b73842e72754195a96af35baba25d69bb52702d6774f981e1a2725cbf05
Instruction ID: 44df5684621f7c417f141441b8cb6ead2a8ac94245acda985ad5a7fdd88b983b
Opcode Fuzzy Hash: 195b6b73842e72754195a96af35baba25d69bb52702d6774f981e1a2725cbf05
Instruction Fuzzy Hash: 1D6189B44083908BD310AF16D851A2BBBF4FFA2755F08491EE4C58B361E3B9C911CB6B

Function 004E7C00 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92da57554aba64526bc176f9895f2bc26bb62373ad8e6b3d5e2260568fc4defa
Instruction ID: f36eca3905f27f6a406c1ab6d3fef8e632fc9696296f65a725518c89b5254575
Opcode Fuzzy Hash: 92da57554aba64526bc176f9895f2bc26bb62373ad8e6b3d5e2260568fc4defa
Instruction Fuzzy Hash: 4351E1B16082449BDB209B26CC86F7733B8EF85369F144959F9858B391F379DC01C76A

Function 004F1860 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: b0f4594cf88dbc42934202e9b28f4382081323c8fad3867cc8d863e09a7faaf8
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: CA61C031A09309DBD714CE29C58073FBBE2ABC5350F64C92FE6898B361D2B8DD41974A

Function 004F82D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ff08711b6fa7dd5b368fbed12cf0d6747c88c2c415fee95f0274b372c62b8e
Instruction ID: 23c7a7194acf240c9f2a17cdd93deefedf285dba6b746424c7dcaa9843cc7ae0
Opcode Fuzzy Hash: c8ff08711b6fa7dd5b368fbed12cf0d6747c88c2c415fee95f0274b372c62b8e
Instruction Fuzzy Hash: 45611423A1A9A44BC314453C5C453BA6A835BE2334F3EC36F9AB18F3F5D96E48065246

Function 004D42FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93af71934a59125396275d3b553c4b9c2fd415f4b9993dcbf1bec4615321d22c
Instruction ID: a6cdb0a294622b2de4ef75b2fecdf6fcc2b4c935725dafa596b3a44a1561861f
Opcode Fuzzy Hash: 93af71934a59125396275d3b553c4b9c2fd415f4b9993dcbf1bec4615321d22c
Instruction Fuzzy Hash: 1B81E1B4810B00AFD360EF39D947757BEF4AB06201F404A2EE4EA97695E7306419CBE7

Function 004FE8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: c33fa5b3f5a6a492fb50b9bbcd93dbfe07bc2c5b52e47bd51f344f66732e419b
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: 58517DB15087548FE314DF69D49436BBBE1BBC5318F044E2EE5E983390E379D6088B86

Function 0064BF62 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 158bf18fad9db5949caf6d4a16d665f6dbe62b65662e3d3a85202174ca19e4d0
Instruction ID: 815415eea5efde862f54d67df4afff44ec1955ae1293cac944e657adf1098697
Opcode Fuzzy Hash: 158bf18fad9db5949caf6d4a16d665f6dbe62b65662e3d3a85202174ca19e4d0
Instruction Fuzzy Hash: C95139B3E0D3185BE3142D6DEC993A5F7D9DB90320F2B023EDA9893780EC75680546C9

Function 00507520 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 098c18f424ef626849d3188dde9395458a4598805569eace4418802e0612f5e7
Instruction ID: 174e68eb1e6b6050ce6377bcc76fa27feb19d5c482c6cbb0a1d10b79e2ce2f57
Opcode Fuzzy Hash: 098c18f424ef626849d3188dde9395458a4598805569eace4418802e0612f5e7
Instruction Fuzzy Hash: 9851E631A0C6149BC7159E18CC91B2EBFE6FBC9354F688A2CE8D6573D1D632BC148791

Function 006C85CA Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27cdf5874b40b42ebecd3981c4b7dd5304978e2175f826b5ffb524c1bf123f0c
Instruction ID: 8f5969ef485ff60236e05ea0658cbfc25c4a9471732ce919f2f9f316e36ccc9c
Opcode Fuzzy Hash: 27cdf5874b40b42ebecd3981c4b7dd5304978e2175f826b5ffb524c1bf123f0c
Instruction Fuzzy Hash: AF51E8B360C600DFD3256A19DC95F7EBBD6EF84320F35482DD6C687340E935580297AA

Function 0057EF40 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f94ca0d3350a679632154558473358a69b8f1c1b89ab13c68aef8e71da53a05
Instruction ID: cda4a26ae7edfbb7943b1eff421dac896651181fa21f6e464018f14327949610
Opcode Fuzzy Hash: 1f94ca0d3350a679632154558473358a69b8f1c1b89ab13c68aef8e71da53a05
Instruction Fuzzy Hash: DE5129F3A186048FF704AA1DDC4577AB7D6DFD4720F1A863CE78587384F93568058286

Function 004C5A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87787edc7365ed803443071da8695431eae0322bf18d48a05f760e38c0778bae
Instruction ID: a05caab9a9940183570e63241558444ca31e92828ada235ec046bd1af2843b84
Opcode Fuzzy Hash: 87787edc7365ed803443071da8695431eae0322bf18d48a05f760e38c0778bae
Instruction Fuzzy Hash: B25105789047049FC754DF14D880E2BB7A0FF85328F15466EE8998B342E635FC82CB9A

Function 0065CB4D Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af9860e0c4f34a985311831989085037c1410c4ad5764f86a29af4aa2b4354fc
Instruction ID: 61c5e0474c43dff13afd82e679b85e7c03060e4914af9dc3ec1db640fa49a1f4
Opcode Fuzzy Hash: af9860e0c4f34a985311831989085037c1410c4ad5764f86a29af4aa2b4354fc
Instruction Fuzzy Hash: 934129F3A0C2044FE3086E3DEC8533AB7D5EB94360F17463DEA89977C0E97658058682

Function 004EEC48 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34711097712499de8d16422c2674d3083384d220e3aafc4173dcc668b0986212
Instruction ID: 23ca2e98d9d8b83e048cbe0e1aa453778c107e402423f0ec14c39690b4f3c057
Opcode Fuzzy Hash: 34711097712499de8d16422c2674d3083384d220e3aafc4173dcc668b0986212
Instruction Fuzzy Hash: 5741D17490035ADBCF208F56DC91BAEB7B0FF0A301F144549E945AB391EB399950CB99

Function 00509B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7187f89a50ad04e2453f8e0ca69b93e6bfa6d95b7590ccccb140d85c0ae274bd
Instruction ID: c83ecf748880aef949d3a1dc469044c50daab29a3d35a1f394598b306ec854e1
Opcode Fuzzy Hash: 7187f89a50ad04e2453f8e0ca69b93e6bfa6d95b7590ccccb140d85c0ae274bd
Instruction Fuzzy Hash: E7418E74608300ABE710DB15D991B2FBBEAFB95754F54882CF58A972D2D335EC00DBA2

Function 004D2030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9991c508b428184898ec33d42568b6b3c099f30009c2184721a750ffee5e7464
Instruction ID: 77b6a881e111868ac7b901430a4c5628011fe1f92a15bc86b066e7542412d6cb
Opcode Fuzzy Hash: 9991c508b428184898ec33d42568b6b3c099f30009c2184721a750ffee5e7464
Instruction Fuzzy Hash: A341FA32A083654FD35DCF2984A023EBBE2ABD5300F09C62FE5D6873D0DAB88945D785

Function 004D1E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7971c75f182ad931126a291f28e7c680f4175985b0a60c4747af25eccd0d99c9
Instruction ID: 798ef3dcec97a5cc8b358cfcd1e03c0a3bf41dbae1357cdc9fd96a9a99015381
Opcode Fuzzy Hash: 7971c75f182ad931126a291f28e7c680f4175985b0a60c4747af25eccd0d99c9
Instruction Fuzzy Hash: 73410174508380ABC320AB55C894B1EFBF5FB96745F144D1EFAC497392C37AD8148B6A

Function 00508D8A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aca4715cffcfe6adb1218dde44eb54a746d2241b4a6892b5d76f4bf9ddc7a37
Instruction ID: 61910432c9ce7757ce0d73a55404e38dfb8650822e3c05cf453cfba4af0236a5
Opcode Fuzzy Hash: 9aca4715cffcfe6adb1218dde44eb54a746d2241b4a6892b5d76f4bf9ddc7a37
Instruction Fuzzy Hash: 3C41AE326087518FD704DF68C49092EFFE6BF99300F198A2DE4D59B2A2DB75DD058B82

Function 004DD961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac69cc217c2528b7ac22437e43e489988d1a382f73b3ce80bcb4c2e632ca1091
Instruction ID: c40a3ab285281757288b6ba6bd9d82371539cbcd40ccca3f7ebceb1f684f5492
Opcode Fuzzy Hash: ac69cc217c2528b7ac22437e43e489988d1a382f73b3ce80bcb4c2e632ca1091
Instruction Fuzzy Hash: 1F41EFB59483818BD7308F10C895BABB3B0FFA6354F04485EE48A8B791D7B94840CB5B

Function 004FF030 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: c50a77da4ce2acb20f2ebe4e74d9a8519b76baead7a626f838d5d9cf27debf41
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: 59210A329081284BC3249B59C58153BF7E4EF9A704F06863ED9C497395E7399C14C7D5

Function 005067EF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0cf4a530e8cea041d40bbee05cc3638009a18bcbde2d22f5195200af3d012da
Instruction ID: e69ded987b281c36d339594382be2e3227b3b94c7627bdc04c8dc241930a774e
Opcode Fuzzy Hash: b0cf4a530e8cea041d40bbee05cc3638009a18bcbde2d22f5195200af3d012da
Instruction Fuzzy Hash: 333104705183829AE714CF14C49066FBFF0BF96784F54980DF4C8AB2A2D334D995CB9A

Function 004E5E70 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8477dd08b150aaa332f0a437cd6bf48bef50d53525ca78e4a1f72e3d5fcafe62
Instruction ID: 3a98d4bbaf58d6f2ab9b7a30fea6ab41bc5abb613c63c61f04ada6b0592899ee
Opcode Fuzzy Hash: 8477dd08b150aaa332f0a437cd6bf48bef50d53525ca78e4a1f72e3d5fcafe62
Instruction Fuzzy Hash: C821B275508241DBC310AF19C85192BB7F4EF9676AF44890DF4D99B392E339C900DBAB

Function 004C49A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction ID: 755492e3d252762b371a934a063acee2e92cb5d87508f7c64aa6b18f97eb68d6
Opcode Fuzzy Hash: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction Fuzzy Hash: 0D31DB796482109BD7509E59D990F3BB7E1EFC4358F18852EE89A87341D23ADC42CB4E

Function 005064B8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a06122d2931e3eaf1efe2e3e5edcbba0767b39342300051297c613073dad175
Instruction ID: d3cd46293fdc78f0e879d1cca4c2accf5a2feecfe84c48e2d90dc78d7837c790
Opcode Fuzzy Hash: 3a06122d2931e3eaf1efe2e3e5edcbba0767b39342300051297c613073dad175
Instruction Fuzzy Hash: CE21787460C201DBDB08EF19D4C0A2EFBE2FB95740F28881CE4C5933A1D330A864DB62

Function 004FB650 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 741b2e6486ed2f0c2c2ad933ee1eb6e2dd35d5639fcbdcbb3114ebb77aa2969c
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: E211E933A051DD0ED3168D3CC840575BFA35AA7234B59439AF4B4DB2D2D7268D8A839A

Function 004F0B80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: 838c4546505ff2a6a009a6c0f1b747f2db9d792ba9c3480357652182f15a3749
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: DC0175F5A0030647E7209E9698D5B3BB2A86FC071CF18453EDA0A57343DB7AFC05C699

Function 004ED1E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20550a83185eba400b85091820293d08a6482b06dece31e9b663af93ef147f12
Instruction ID: 2788fcbcd3104d288aa98a1edb9cbb0b7048b4e57d183682ea580464109f7d69
Opcode Fuzzy Hash: 20550a83185eba400b85091820293d08a6482b06dece31e9b663af93ef147f12
Instruction Fuzzy Hash: FF11ECB0408380AFD3109F618598A2FFBE5EBA6754F148C4DF6A49B251C379E819CF5A

Function 004C6EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9b082782d33b5b7200b01d4da8b77a577bd324fa196adb733eec959726904a5
Instruction ID: 8fa6bb37aacf28433cefdb0276e2b50cba4a6a949f414dd5cc2905b5e46d7919
Opcode Fuzzy Hash: d9b082782d33b5b7200b01d4da8b77a577bd324fa196adb733eec959726904a5
Instruction Fuzzy Hash: 2AF0243E71820A0BF250CDAAA8C4D3BB396D7D9355B05953EEB41C3301CDB2E8069194

Function 004FB8C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 004DC5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 004DB410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: d649376117471119e66bd6d998ece9d6ec6fc8927ba681e33f46a6da45d8c316
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: 01F0ECB160461097DF22CA559CD4F3BBBDCCB97354F1A042BE84557303D2655845C3E9

Function 004F8220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd10b58c04f073865917c471d2f3a6e1dd5bb487b77383bee63973e291d422d3
Instruction ID: 7b5d3561ebc263303eaee26b25917e7cab8dd7210ca0e3bc5c6cb06546ec4684
Opcode Fuzzy Hash: cd10b58c04f073865917c471d2f3a6e1dd5bb487b77383bee63973e291d422d3
Instruction Fuzzy Hash: 8601E4B04107009FD360EF29C44575BBBF8FB09714F004A1DE8AECB680D770A5488B82

Function 00501440 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 4cbac0759aaca93f006aae131248f4b8ea99ab86e3c42f698924f9b6023340bb
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 94D05E21608721469F648E19A40097BFBE0FA87B11B49955EF586E3198D230DC41C2AE

Function 004D1ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 191da7deb793ffbd2549e03bd830cf0da893fc8b3ece357dd3c59acda7b2f86e
Instruction ID: 7176575e882bc0593454216cd46e8a5dbaae49aac29442bfc990e45338452b1e
Opcode Fuzzy Hash: 191da7deb793ffbd2549e03bd830cf0da893fc8b3ece357dd3c59acda7b2f86e
Instruction Fuzzy Hash: 42C08C34A180008BCA14CF00FCE557AB3B8A327308700B03BEE03F3B31DA60D40AAA0A

Function 00506094 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab8003871aeb9bf7f5e0da34e259dc8000cfda883471a6e43d8a8ee9f4277df
Instruction ID: fab939953844ef4610c8bac4802906469d61b59c86191400a4db57c7149bfc9c
Opcode Fuzzy Hash: cab8003871aeb9bf7f5e0da34e259dc8000cfda883471a6e43d8a8ee9f4277df
Instruction Fuzzy Hash: EEC09B3465C40087D70CCF04D9614B5F7B79BA7754724F01DC80733295E138D916A91C

Function 004D1A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62dfc35504cadd4606e771ba9d26f684c6451563da887733f5b9b7fda7b75f56
Instruction ID: 5bf865ec87325c23dfb5cebb50a1056593b7eb0f7d1fe87ec7aed30019df7825
Opcode Fuzzy Hash: 62dfc35504cadd4606e771ba9d26f684c6451563da887733f5b9b7fda7b75f56
Instruction Fuzzy Hash: 7DC04C24A590408AC654CE85A8E1535A2A85316208710303B9E02F7761D560D4099609

Function 00505FD6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1755550397.00000000004C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.1755478735.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000698000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755794033.00000000007BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756492716.00000000007BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756708341.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1756733240.0000000000952000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40f483856076b7a7b83b2c0f24c16e365ddd86d3e0ceb1148d2dac7456ef1404
Instruction ID: bf2fe61168d7f2b8876ecd78b4dd5322feab9c77080e9dd0fc9e7995e6332bbc
Opcode Fuzzy Hash: 40f483856076b7a7b83b2c0f24c16e365ddd86d3e0ceb1148d2dac7456ef1404
Instruction Fuzzy Hash: 3FC09224B6C0008BA74CCF18DD619B5F2FA9BABA18B14F02DC807B3256E138D91A960C

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
file.exe

Function 004CFCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Function 004CD110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Function 00505700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Function 00505BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 0050695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Function 004D049B Relevance: .3, Instructions: 264
COMMON

Function 004D0228 Relevance: .2, Instructions: 218
COMMON

Function 00503220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 00503202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON