Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1527621
MD5:	86d82964c577f6b26d904e4417b16178
SHA1:	e3711aa266bf13c33ab29678f8520594dc2dbf8d
SHA256:	b81c59ad55cdeb8b6003e41d467098a7395737c6cd72b5f57ee789fbdbff195b
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6728 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 86D82964C577F6B26D904E4417B16178)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["bathdoomgaz.stor", "mobbipenju.stor", "dissapoiznw.stor", "studennotediw.stor", "licendfilteo.site", "clearancek.site", "eaglepawnoy.stor", "spirittunek.stor"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:52:05.083993+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.5	49426	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:52:04.799601+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.5	53012	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:52:04.903486+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.5	56520	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:52:04.893095+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.5	58230	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:52:05.106926+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.5	59487	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:52:04.875367+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.5	63921	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:52:05.096957+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.5	63789	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:52:05.071567+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.5	59877	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900

URL Reputation: Label: malware

Found malware configuration

Source: file.exe.6728.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["bathdoomgaz.stor", "mobbipenju.stor", "dissapoiznw.stor", "studennotediw.stor", "licendfilteo.site", "clearancek.site", "eaglepawnoy.stor", "spirittunek.stor"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for domain / URL

Source: eaglepawnoy.store	Virustotal: Detection: 13%	Perma Link
Source: spirittunek.store	Virustotal: Detection: 13%	Perma Link
Source: licendfilteo.site	Virustotal: Detection: 12%	Perma Link
Source: mobbipenju.store	Virustotal: Detection: 13%	Perma Link
Source: studennotediw.store	Virustotal: Detection: 13%	Perma Link
Source: clearancek.site	Virustotal: Detection: 13%	Perma Link
Source: dissapoiznw.store	Virustotal: Detection: 13%	Perma Link
Source: bathdoomgaz.store	Virustotal: Detection: 13%	Perma Link
Source: https://bathdoomgaz.store:443/api	Virustotal: Detection: 13%	Perma Link
Source: https://clearancek.site:443/api	Virustotal: Detection: 13%	Perma Link
Source: https://eaglepawnoy.store:443/api	Virustotal: Detection: 13%	Perma Link
Source: licendfilteo.site	Virustotal: Detection: 12%	Perma Link
Source: https://steamcommunity.com:443/profiles/76561199724331900	Virustotal: Detection: 8%	Perma Link
Source: clearancek.site	Virustotal: Detection: 13%	Perma Link
Source: https://mobbipenju.store:443/api	Virustotal: Detection: 13%	Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.stor
Source: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.stor
Source: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.stor
Source: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.stor
Source: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.stor
Source: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.stor
Source: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0020D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0020D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_002463B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_0024695B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_002499D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_0020FCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00216F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then dec ebx	0_2_0023F030
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_00201000
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00244040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00246094
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_0022D1E1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00222260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00222260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_002142FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	0_2_0020A300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_002323E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_002323E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_002323E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_002323E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_002323E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_002323E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0022E40C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_0021B410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_0022C470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_00241440
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0021D457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_002464B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_00247520
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00216536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00229510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	0_2_00208590
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0022E66A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_0023B650
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00245700
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_00247710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0022D7AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_002467EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_002228E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00243920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_0021D961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_002049A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00211A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00244A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00205A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00211ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00249B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_0021DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_0021DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00230B80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00213BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00211BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_0023FC20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00227C00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_0022EC48
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_0022AC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_0022AC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00249CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00249CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_0022CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0022CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_0022CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0022DD29
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_0022FD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00248D8A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, ecx	0_2_00214E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00227E60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00225E70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_0022AE57
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_00206EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_0020BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_00216EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00211E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00210EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00229F62
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0023FF70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00216F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00247FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00247FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00208FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00245FD6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_0021FFDF

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.5:58230 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.5:53012 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.5:59877 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.5:59487 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.5:63789 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.5:63921 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.5:56520 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.5:49426 -> 1.1.1.1:53

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: bathdoomgaz.stor
Source: Malware configuration extractor	URLs: mobbipenju.stor
Source: Malware configuration extractor	URLs: dissapoiznw.stor
Source: Malware configuration extractor	URLs: studennotediw.stor
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: eaglepawnoy.stor
Source: Malware configuration extractor	URLs: spirittunek.stor

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: file.exe, 00000000.00000003.2108316535.0000000001241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=87e8c62e176ffbfb40e2f3ad; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type25489Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 07 Oct 2024 04:52:06 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control+ equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000000.00000003.2108202643.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store:443/api
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000000.00000003.2108202643.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/api
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: file.exe, 00000000.00000003.2108202643.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eaglepawnoy.store:443/api
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000000.00000003.2108202643.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site:443/apiz
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000000.00000003.2108202643.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobbipenju.store:443/api
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: file.exe, 00000000.00000003.2108202643.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store:443/api
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000003.2108115469.0000000001241000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/p
Source: file.exe, 00000000.00000002.2109320528.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108357594.00000000011F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000002.2109320528.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108357594.00000000011F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900P
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000003.2108202643.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.2108115469.0000000001241000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108316535.0000000001241000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000000.00000003.2108115469.0000000001241000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f
Source: file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.2108202643.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://studennotediw.store:443/apiI
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49704 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00210228	0_2_00210228
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00212030	0_2_00212030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00201000	0_2_00201000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003	0_2_003E5003
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D1065	0_2_003D1065
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00244040	0_2_00244040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003CE081	0_2_003CE081
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0024A0D0	0_2_0024A0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00205160	0_2_00205160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0020E1A0	0_2_0020E1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002071F0	0_2_002071F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002012F7	0_2_002012F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002382D0	0_2_002382D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002312D0	0_2_002312D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0020A300	0_2_0020A300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0020B3A0	0_2_0020B3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002013A3	0_2_002013A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D9389	0_2_003D9389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00329388	0_2_00329388
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002323E0	0_2_002323E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E0419	0_2_003E0419
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0022C470	0_2_0022C470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00214487	0_2_00214487
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0021049B	0_2_0021049B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002364F0	0_2_002364F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D4500	0_2_003D4500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E3562	0_2_003E3562
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003095BE	0_2_003095BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002035B0	0_2_002035B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00208590	0_2_00208590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0021C5F0	0_2_0021C5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003DE5CB	0_2_003DE5CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0023F620	0_2_0023F620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0020164F	0_2_0020164F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00248652	0_2_00248652
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002486F0	0_2_002486F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003776C9	0_2_003776C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002F57DC	0_2_002F57DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00231860	0_2_00231860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0020A850	0_2_0020A850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0023E8A0	0_2_0023E8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0023B8C0	0_2_0023B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A091D	0_2_003A091D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002489A0	0_2_002489A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0022098B	0_2_0022098B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003DCA73	0_2_003DCA73
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00244A40	0_2_00244A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D2A50	0_2_003D2A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00247AB0	0_2_00247AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00248A80	0_2_00248A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E6AED	0_2_003E6AED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0021DB6F	0_2_0021DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E1B41	0_2_003E1B41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00207BF0	0_2_00207BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00248C02	0_2_00248C02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00246CBF	0_2_00246CBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0022CCD0	0_2_0022CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002FBD27	0_2_002FBD27
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0022DD29	0_2_0022DD29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0022FD10	0_2_0022FD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00228D62	0_2_00228D62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002B2E2A	0_2_002B2E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00214E2A	0_2_00214E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00248E70	0_2_00248E70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0022AE57	0_2_0022AE57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0020BEB0	0_2_0020BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00216EBF	0_2_00216EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0020AF10	0_2_0020AF10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002CFF6B	0_2_002CFF6B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003DAFB0	0_2_003DAFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D7F97	0_2_003D7F97
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00247FC0	0_2_00247FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00208FD0	0_2_00208FD0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0020CAA0 appears 48 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0021D300 appears 152 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9994134179042904
Source: file.exe	Static PE information: Section: ncvybzci ZLIB complexity 0.9940358260266786

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@9/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00238220 CoCreateInstance,

0_2_00238220

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior

Source: file.exe

Static file information: File size 1878016 > 1048576

Source: file.exe

Static PE information: Raw size of ncvybzci is bigger than: 0x100000 < 0x1a1000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.200000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ncvybzci:EW;mdqgyexl:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ncvybzci:EW;mdqgyexl:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d9128 should be: 0x1d2148

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ncvybzci
Source: file.exe	Static PE information: section name: mdqgyexl
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push edi; mov dword ptr [esp], esp	0_2_003E5009
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push eax; mov dword ptr [esp], 67EF8B03h	0_2_003E506D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push 57C945E8h; mov dword ptr [esp], edx	0_2_003E509F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push 10E0D48Fh; mov dword ptr [esp], ecx	0_2_003E528F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push 525BE019h; mov dword ptr [esp], ebp	0_2_003E52A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push 0815D040h; mov dword ptr [esp], esi	0_2_003E52CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push 48794E00h; mov dword ptr [esp], ecx	0_2_003E5395
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push esi; mov dword ptr [esp], esp	0_2_003E53ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push 11C208CCh; mov dword ptr [esp], ebp	0_2_003E546A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push eax; mov dword ptr [esp], edx	0_2_003E5476
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push esi; mov dword ptr [esp], eax	0_2_003E54BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push ecx; mov dword ptr [esp], 35418E91h	0_2_003E553E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push 546B2651h; mov dword ptr [esp], edx	0_2_003E5594
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push ecx; mov dword ptr [esp], 78F37B60h	0_2_003E55A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push 799A3E3Bh; mov dword ptr [esp], eax	0_2_003E562B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push 6074F923h; mov dword ptr [esp], edx	0_2_003E5649
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push edi; mov dword ptr [esp], ecx	0_2_003E56B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push 4B23DB1Ch; mov dword ptr [esp], ebp	0_2_003E56E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push edx; mov dword ptr [esp], ebp	0_2_003E572E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push edx; mov dword ptr [esp], edi	0_2_003E5783
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push ebx; mov dword ptr [esp], ecx	0_2_003E57FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push ecx; mov dword ptr [esp], edi	0_2_003E5829
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push ecx; mov dword ptr [esp], 3D3B7417h	0_2_003E582E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push esi; mov dword ptr [esp], edx	0_2_003E5910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push eax; mov dword ptr [esp], ecx	0_2_003E59FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push 5825B2B6h; mov dword ptr [esp], eax	0_2_003E5A1B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push eax; mov dword ptr [esp], 209B73FCh	0_2_003E5A71
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push ebx; mov dword ptr [esp], eax	0_2_003E5A8D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push edi; mov dword ptr [esp], ebp	0_2_003E5AA1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push ebx; mov dword ptr [esp], 3B4B1B64h	0_2_003E5AA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5003 push eax; mov dword ptr [esp], ebx	0_2_003E5AB8

Source: file.exe	Static PE information: section name: entropy: 7.97011971407078
Source: file.exe	Static PE information: section name: ncvybzci entropy: 7.952874075502727

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EC3C1 second address: 3EC3D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F1E04B41E10h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EC3D9 second address: 3EC3DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EC3DD second address: 3EC3E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EBB28 second address: 3EBB2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EBC6D second address: 3EBC81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jc 00007F1E04B41E06h 0x0000000c jne 00007F1E04B41E06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EBC81 second address: 3EBC91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnc 00007F1E04B472D6h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EEB66 second address: 3EEB81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1E04B41E10h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EEB81 second address: 3EEB8B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1E04B472D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EEB8B second address: 3EEB90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EEB90 second address: 3EEBC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jmp 00007F1E04B472E6h 0x00000011 jmp 00007F1E04B472DDh 0x00000016 popad 0x00000017 mov eax, dword ptr [eax] 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EEBC7 second address: 3EEBCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EEBCB second address: 3EEBD9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1E04B472D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EEBD9 second address: 3EEBDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EEBDD second address: 3EEBEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EEC9C second address: 3EED0B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1E04B41E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 5013DCC1h 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F1E04B41E08h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b jnp 00007F1E04B41E0Ch 0x00000031 lea ebx, dword ptr [ebp+1245EA12h] 0x00000037 push 00000000h 0x00000039 push ebx 0x0000003a call 00007F1E04B41E08h 0x0000003f pop ebx 0x00000040 mov dword ptr [esp+04h], ebx 0x00000044 add dword ptr [esp+04h], 00000018h 0x0000004c inc ebx 0x0000004d push ebx 0x0000004e ret 0x0000004f pop ebx 0x00000050 ret 0x00000051 and si, B396h 0x00000056 push eax 0x00000057 jns 00007F1E04B41E14h 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EED0B second address: 3EED0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EED9E second address: 3EEDA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EEDA8 second address: 3EEDAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EEDAC second address: 3EEDB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EEDB0 second address: 3EEE61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push ebx 0x00000009 mov dword ptr [ebp+122D372Ch], edx 0x0000000f pop edx 0x00000010 push 00000000h 0x00000012 mov si, ax 0x00000015 push 80DBA209h 0x0000001a jmp 00007F1E04B472E1h 0x0000001f add dword ptr [esp], 7F245E77h 0x00000026 jmp 00007F1E04B472E5h 0x0000002b push 00000003h 0x0000002d clc 0x0000002e cld 0x0000002f push 00000000h 0x00000031 push 00000003h 0x00000033 mov esi, 03283347h 0x00000038 push 8B4B0D82h 0x0000003d jl 00007F1E04B472EAh 0x00000043 jmp 00007F1E04B472E4h 0x00000048 add dword ptr [esp], 34B4F27Eh 0x0000004f mov edi, dword ptr [ebp+122D35D4h] 0x00000055 lea ebx, dword ptr [ebp+1245EA1Bh] 0x0000005b jbe 00007F1E04B472D8h 0x00000061 mov edx, ebx 0x00000063 xchg eax, ebx 0x00000064 pushad 0x00000065 pushad 0x00000066 jmp 00007F1E04B472E1h 0x0000006b jnp 00007F1E04B472D6h 0x00000071 popad 0x00000072 push eax 0x00000073 push edx 0x00000074 jnp 00007F1E04B472D6h 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EEE61 second address: 3EEE84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B41E18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EEED5 second address: 3EEEEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1E04B472E2h 0x00000009 popad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EEEEF second address: 3EEF00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 ja 00007F1E04B41E14h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EEF00 second address: 3EEF04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FF8BF second address: 3FF8C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FF8C3 second address: 3FF8C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40D011 second address: 40D01A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40D01A second address: 40D024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F1E04B472D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40D2A6 second address: 40D2F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B41E19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007F1E04B41E0Dh 0x0000000f jmp 00007F1E04B41E18h 0x00000014 pop ecx 0x00000015 push ecx 0x00000016 jbe 00007F1E04B41E06h 0x0000001c pop ecx 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push ecx 0x00000021 push esi 0x00000022 pop esi 0x00000023 pop ecx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40D5B8 second address: 40D5C5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1E04B472D8h 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40D78C second address: 40D796 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F1E04B41E06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40D907 second address: 40D91A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1E04B472DEh 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40E1B6 second address: 40E1BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40E1BC second address: 40E1D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1E04B472E3h 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CF0CF second address: 3CF0DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F1E04B41E06h 0x0000000a jns 00007F1E04B41E06h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CF0DF second address: 3CF0E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CF0E3 second address: 3CF10B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1E04B41E0Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1E04B41E10h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CF10B second address: 3CF119 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CF119 second address: 3CF11D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40E302 second address: 40E306 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40E93F second address: 40E956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1E04B41E0Dh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40E956 second address: 40E95D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40E95D second address: 40E977 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B41E12h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F0CA second address: 40F0F4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007F1E04B472ECh 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F0F4 second address: 40F10E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B41E0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f jc 00007F1E04B41E06h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F10E second address: 40F12D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007F1E04B472D6h 0x0000000d jmp 00007F1E04B472E0h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 411191 second address: 411195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 411195 second address: 411199 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 411199 second address: 4111B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push edi 0x0000000a jmp 00007F1E04B41E0Ah 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007F1E04B41E06h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4115EB second address: 4115EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4115EF second address: 4115F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4115F5 second address: 411614 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1E04B472D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1E04B472E0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 411614 second address: 411619 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 419C68 second address: 419C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 419C6C second address: 419C70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 419C70 second address: 419C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1E04B472DCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 419531 second address: 419535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 419535 second address: 41953B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41953B second address: 419565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1E04B41E0Dh 0x0000000d jmp 00007F1E04B41E15h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 419565 second address: 41957D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1E04B472E2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41957D second address: 41958F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1E04B41E0Ch 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41958F second address: 419593 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41987A second address: 419880 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 419880 second address: 419886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41D478 second address: 41D47C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41D47C second address: 41D494 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1E04B472E2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DFC59 second address: 3DFC61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DFC61 second address: 3DFC66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DFC66 second address: 3DFC7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1E04B41E0Fh 0x00000009 jno 00007F1E04B41E06h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DFC7F second address: 3DFC83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DFC83 second address: 3DFC89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41DB1F second address: 41DB4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B472E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 2D966820h 0x00000010 and edi, 2B5C63A1h 0x00000016 push 1B342674h 0x0000001b push edx 0x0000001c push ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41DC80 second address: 41DC86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41DC86 second address: 41DC8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41DDFD second address: 41DE02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41E231 second address: 41E237 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41E72C second address: 41E73B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B41E0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41E73B second address: 41E741 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41E741 second address: 41E745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41E7CD second address: 41E7D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41EB49 second address: 41EB4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41EB4D second address: 41EB5F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1E04B472D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41EE54 second address: 41EE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41EE5D second address: 41EE61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41EEFD second address: 41EF07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F1E04B41E06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41FD90 second address: 41FD98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41FD98 second address: 41FE02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F1E04B41E08h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D2630h], edi 0x00000029 push 00000000h 0x0000002b add esi, 08218100h 0x00000031 push 00000000h 0x00000033 mov si, B078h 0x00000037 xchg eax, ebx 0x00000038 pushad 0x00000039 jmp 00007F1E04B41E15h 0x0000003e jnp 00007F1E04B41E08h 0x00000044 pushad 0x00000045 popad 0x00000046 popad 0x00000047 push eax 0x00000048 jc 00007F1E04B41E0Eh 0x0000004e push ecx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 420E99 second address: 420F24 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1E04B472D8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e push esi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop esi 0x00000012 pop ebx 0x00000013 nop 0x00000014 push eax 0x00000015 pushad 0x00000016 jp 00007F1E04B472D6h 0x0000001c mov dword ptr [ebp+12486260h], esi 0x00000022 popad 0x00000023 pop esi 0x00000024 mov esi, dword ptr [ebp+122D2B62h] 0x0000002a push 00000000h 0x0000002c jg 00007F1E04B472DEh 0x00000032 push 00000000h 0x00000034 jmp 00007F1E04B472DEh 0x00000039 call 00007F1E04B472E7h 0x0000003e mov edi, 2434F4EFh 0x00000043 pop edi 0x00000044 xchg eax, ebx 0x00000045 jmp 00007F1E04B472E4h 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d js 00007F1E04B472DCh 0x00000053 js 00007F1E04B472D6h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42054A second address: 420561 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B41E0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42249E second address: 4224AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4224AB second address: 4224BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1E04B41E0Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4224BD second address: 4224C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 422F42 second address: 422F48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 422CDE second address: 422CFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1E04B472E9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 422FDD second address: 422FE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 422FE1 second address: 422FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 422FE7 second address: 423001 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1E04B41E16h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4273FD second address: 427402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 427402 second address: 427415 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1E04B41E08h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 427415 second address: 42741F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1E04B472D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 427962 second address: 42796C instructions: 0x00000000 rdtsc 0x00000002 je 00007F1E04B41E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42796C second address: 427976 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F1E04B472D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4299E6 second address: 429A2E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b xor bh, FFFFFFFBh 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F1E04B41E08h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a mov dword ptr [ebp+1248CC46h], ebx 0x00000030 push 00000000h 0x00000032 mov ebx, 12FF99DFh 0x00000037 or ebx, dword ptr [ebp+122D386Ah] 0x0000003d push eax 0x0000003e pushad 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 429A2E second address: 429A4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1E04B472D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1E04B472E1h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 429A4C second address: 429A50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42CA3E second address: 42CA47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42CA47 second address: 42CA6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jmp 00007F1E04B41E17h 0x0000000c jo 00007F1E04B41E1Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42ABBA second address: 42ABBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42ABBF second address: 42ABE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F1E04B41E06h 0x00000009 jmp 00007F1E04B41E12h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007F1E04B41E0Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42ABE8 second address: 42ABEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42ABEC second address: 42ABF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42D2A3 second address: 42D33F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B472DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jl 00007F1E04B472D6h 0x00000010 jnp 00007F1E04B472D6h 0x00000016 popad 0x00000017 popad 0x00000018 mov dword ptr [esp], eax 0x0000001b or ebx, 483D1EE5h 0x00000021 push dword ptr fs:[00000000h] 0x00000028 jl 00007F1E04B472E0h 0x0000002e pushad 0x0000002f jg 00007F1E04B472D6h 0x00000035 pushad 0x00000036 popad 0x00000037 popad 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f mov ebx, eax 0x00000041 mov eax, dword ptr [ebp+122D0A29h] 0x00000047 push 00000000h 0x00000049 push ebx 0x0000004a call 00007F1E04B472D8h 0x0000004f pop ebx 0x00000050 mov dword ptr [esp+04h], ebx 0x00000054 add dword ptr [esp+04h], 00000019h 0x0000005c inc ebx 0x0000005d push ebx 0x0000005e ret 0x0000005f pop ebx 0x00000060 ret 0x00000061 push FFFFFFFFh 0x00000063 push 00000000h 0x00000065 push edx 0x00000066 call 00007F1E04B472D8h 0x0000006b pop edx 0x0000006c mov dword ptr [esp+04h], edx 0x00000070 add dword ptr [esp+04h], 0000001Ch 0x00000078 inc edx 0x00000079 push edx 0x0000007a ret 0x0000007b pop edx 0x0000007c ret 0x0000007d push eax 0x0000007e push edi 0x0000007f pushad 0x00000080 push eax 0x00000081 push edx 0x00000082 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42F2D2 second address: 42F2D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42F2D6 second address: 42F2DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42E3E2 second address: 42E3E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4302E0 second address: 430316 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 nop 0x00000007 cld 0x00000008 push 00000000h 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F1E04B472D8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 push 00000000h 0x00000026 or ebx, 4777814Bh 0x0000002c push eax 0x0000002d push ebx 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43045B second address: 430460 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 430460 second address: 430502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F1E04B472D8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 push dword ptr fs:[00000000h] 0x0000002b push 00000000h 0x0000002d push ebx 0x0000002e call 00007F1E04B472D8h 0x00000033 pop ebx 0x00000034 mov dword ptr [esp+04h], ebx 0x00000038 add dword ptr [esp+04h], 00000017h 0x00000040 inc ebx 0x00000041 push ebx 0x00000042 ret 0x00000043 pop ebx 0x00000044 ret 0x00000045 call 00007F1E04B472DDh 0x0000004a jno 00007F1E04B472DCh 0x00000050 pop ebx 0x00000051 mov dword ptr fs:[00000000h], esp 0x00000058 mov ebx, dword ptr [ebp+122D34E4h] 0x0000005e mov eax, dword ptr [ebp+122D0AADh] 0x00000064 mov ebx, dword ptr [ebp+122D36B5h] 0x0000006a push FFFFFFFFh 0x0000006c sbb edi, 5DEB06C2h 0x00000072 mov di, 63BAh 0x00000076 nop 0x00000077 push eax 0x00000078 push edx 0x00000079 push esi 0x0000007a jmp 00007F1E04B472E0h 0x0000007f pop esi 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 430502 second address: 430528 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1E04B41E14h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007F1E04B41E06h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 432306 second address: 432317 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1E04B472DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 432317 second address: 43231B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43231B second address: 43235D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 clc 0x0000000a push 00000000h 0x0000000c mov bl, 54h 0x0000000e push 00000000h 0x00000010 jo 00007F1E04B472ECh 0x00000016 jns 00007F1E04B472E6h 0x0000001c pushad 0x0000001d jo 00007F1E04B472D9h 0x00000023 movzx ebx, ax 0x00000026 add dword ptr [ebp+12484EF4h], edi 0x0000002c popad 0x0000002d push eax 0x0000002e pushad 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43235D second address: 432368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4343F4 second address: 4343F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4352AE second address: 435330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F1E04B41E06h 0x0000000a popad 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F1E04B41E08h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 mov bx, B8FFh 0x0000002d jc 00007F1E04B41E0Ah 0x00000033 mov bx, 5147h 0x00000037 push 00000000h 0x00000039 jmp 00007F1E04B41E13h 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push esi 0x00000043 call 00007F1E04B41E08h 0x00000048 pop esi 0x00000049 mov dword ptr [esp+04h], esi 0x0000004d add dword ptr [esp+04h], 0000001Dh 0x00000055 inc esi 0x00000056 push esi 0x00000057 ret 0x00000058 pop esi 0x00000059 ret 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d jl 00007F1E04B41E08h 0x00000063 push ebx 0x00000064 pop ebx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 432586 second address: 43258A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43258A second address: 432590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 432590 second address: 432595 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4362E0 second address: 436374 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1E04B41E17h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F1E04B41E08h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 mov edi, dword ptr [ebp+122D2B12h] 0x0000002b movzx ebx, ax 0x0000002e push 00000000h 0x00000030 sub bh, FFFFFFDBh 0x00000033 xor dword ptr [ebp+122D3707h], ecx 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ecx 0x0000003e call 00007F1E04B41E08h 0x00000043 pop ecx 0x00000044 mov dword ptr [esp+04h], ecx 0x00000048 add dword ptr [esp+04h], 00000014h 0x00000050 inc ecx 0x00000051 push ecx 0x00000052 ret 0x00000053 pop ecx 0x00000054 ret 0x00000055 mov edi, esi 0x00000057 xor dword ptr [ebp+12484038h], ecx 0x0000005d xchg eax, esi 0x0000005e push edx 0x0000005f jmp 00007F1E04B41E0Ch 0x00000064 pop edx 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007F1E04B41E0Fh 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4354D6 second address: 4354E0 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1E04B472D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 436503 second address: 43650E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F1E04B41E06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 438501 second address: 43851F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1E04B472E4h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 438726 second address: 43872A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43872A second address: 43872E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 440E46 second address: 440E4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 440E4A second address: 440E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F1E04B472E2h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 441004 second address: 441008 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44114A second address: 441157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F1E04B472D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 441157 second address: 44115B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44115B second address: 441161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 441161 second address: 44117E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F1E04B41E12h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 442D43 second address: 442D67 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1E04B472D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007F1E04B472E8h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D00E second address: 44D035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1E04B41E19h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D318 second address: 44D31C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D489 second address: 44D48F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D48F second address: 44D493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D8D4 second address: 44D8E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F1E04B41E06h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D8E2 second address: 44D8F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B472DCh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D8F8 second address: 44D8FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D8FE second address: 44D904 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D904 second address: 44D910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D910 second address: 44D914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D914 second address: 44D918 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D918 second address: 44D91E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 452134 second address: 45213A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45213A second address: 45213E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4522BA second address: 4522BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4522BE second address: 4522C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4526C3 second address: 4526C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4526C9 second address: 4526CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4526CF second address: 4526D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4526D3 second address: 4526D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4526D9 second address: 4526E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4526E6 second address: 452719 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B472E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F1E04B472E9h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 452719 second address: 45271D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45286E second address: 452872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 452B89 second address: 452B8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 452FD0 second address: 452FD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 452FD4 second address: 453017 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1E04B41E15h 0x0000000b popad 0x0000000c push esi 0x0000000d push edi 0x0000000e ja 00007F1E04B41E06h 0x00000014 jmp 00007F1E04B41E0Fh 0x00000019 pop edi 0x0000001a pushad 0x0000001b jnp 00007F1E04B41E06h 0x00000021 jp 00007F1E04B41E06h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 406163 second address: 406180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F1E04B472E3h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 406180 second address: 406188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 457A2D second address: 457A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 457A31 second address: 457A3A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 425918 second address: 42591C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 426024 second address: 42603D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jmp 00007F1E04B41E0Dh 0x0000000a pop edx 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 426219 second address: 42621F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4263A4 second address: 4263A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4263A8 second address: 4263B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007F1E04B472D6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 426A52 second address: 426A56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 426A56 second address: 426A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jl 00007F1E04B472DCh 0x00000012 jp 00007F1E04B472D6h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 426A72 second address: 426A76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 426A76 second address: 426A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jnc 00007F1E04B472E0h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jns 00007F1E04B472D6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 426A9D second address: 426AA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 426B06 second address: 426B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1E04B472E3h 0x00000009 popad 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e call 00007F1E04B472DCh 0x00000013 js 00007F1E04B472DCh 0x00000019 sub dword ptr [ebp+1246F211h], eax 0x0000001f pop ecx 0x00000020 lea eax, dword ptr [ebp+124956CBh] 0x00000026 pushad 0x00000027 call 00007F1E04B472E6h 0x0000002c mov esi, dword ptr [ebp+122D294Eh] 0x00000032 pop edx 0x00000033 mov ebx, ecx 0x00000035 popad 0x00000036 nop 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F1E04B472E1h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 426B76 second address: 406163 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1E04B41E08h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F1E04B41E12h 0x00000012 nop 0x00000013 mov edx, eax 0x00000015 lea eax, dword ptr [ebp+12495687h] 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007F1E04B41E08h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 sub dword ptr [ebp+122D1E68h], ebx 0x0000003b jmp 00007F1E04B41E14h 0x00000040 push eax 0x00000041 jnc 00007F1E04B41E0Ch 0x00000047 mov dword ptr [esp], eax 0x0000004a mov dword ptr [ebp+122D354Eh], ecx 0x00000050 xor dword ptr [ebp+122D2DF1h], ecx 0x00000056 call dword ptr [ebp+122D3754h] 0x0000005c pushad 0x0000005d push ecx 0x0000005e jc 00007F1E04B41E06h 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 457D3F second address: 457D51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007F1E04B472DEh 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 457D51 second address: 457D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jne 00007F1E04B41E08h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 457D65 second address: 457D69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 457D69 second address: 457D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 457D75 second address: 457D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 457FDE second address: 457FF3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1E04B41E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007F1E04B41E06h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 457FF3 second address: 457FF9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 457FF9 second address: 457FFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 457FFE second address: 458006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 458407 second address: 458417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnl 00007F1E04B41E06h 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 458672 second address: 45867C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45867C second address: 458682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 458682 second address: 458688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E8D1 second address: 45E8E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1E04B41E0Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464AE5 second address: 464AFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jng 00007F1E04B472E2h 0x0000000b jbe 00007F1E04B472D6h 0x00000011 jp 00007F1E04B472D6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464AFC second address: 464B1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F1E04B41E11h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F1E04B41E06h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464B1D second address: 464B2B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jnl 00007F1E04B472D6h 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463E38 second address: 463E4C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1E04B41E0Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463E4C second address: 463E5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F1E04B472D6h 0x0000000a ja 00007F1E04B472D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463E5C second address: 463E7F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F1E04B41E19h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4635C7 second address: 4635CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4635CD second address: 4635D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1E04B41E06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4635D8 second address: 4635EA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F1E04B472F0h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4643CE second address: 4643DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4643DA second address: 4643DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4643DE second address: 4643E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4643E2 second address: 4643E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4643E8 second address: 4643EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4643EE second address: 4643F3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464552 second address: 46455D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jp 00007F1E04B41E06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4647DA second address: 4647FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B472E4h 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F1E04B472D6h 0x0000000f ja 00007F1E04B472D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4647FE second address: 464802 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 467350 second address: 46736C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B472DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F1E04B472EAh 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 467685 second address: 467694 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1E04B41E06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 467694 second address: 4676A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 jo 00007F1E04B472F0h 0x0000000c ja 00007F1E04B472DCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4676A8 second address: 4676AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469D5B second address: 469D7B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F1E04B472DDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1E04B472DBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4698D2 second address: 46990F instructions: 0x00000000 rdtsc 0x00000002 je 00007F1E04B41E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F1E04B41E11h 0x00000010 jmp 00007F1E04B41E14h 0x00000015 jmp 00007F1E04B41E0Bh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46990F second address: 46991E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F1E04B472D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46991E second address: 469922 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469922 second address: 469932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F1E04B472D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D128 second address: 46D13E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1E04B41E12h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D13E second address: 46D144 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D144 second address: 46D148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D148 second address: 46D14C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D14C second address: 46D152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D2B1 second address: 46D2C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1E04B472E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D706 second address: 46D70C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D70C second address: 46D710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 471A05 second address: 471A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F1E04B41E06h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 471A12 second address: 471A18 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 471A18 second address: 471A20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 471B61 second address: 471B65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 471B65 second address: 471B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 471B6B second address: 471B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 471B71 second address: 471B8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1E04B41E16h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 471E67 second address: 471E7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F1E04B472DEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 471E7A second address: 471E7F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 471FD6 second address: 471FDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 471FDA second address: 471FEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B41E0Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 471FEC second address: 471FF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 471FF6 second address: 471FFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 471FFA second address: 472000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 426548 second address: 4265A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1E04B41E0Bh 0x0000000f pop edx 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F1E04B41E08h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b mov dword ptr [ebp+122D214Bh], edx 0x00000031 push 00000004h 0x00000033 mov di, bx 0x00000036 push edx 0x00000037 mov dx, di 0x0000003a pop edi 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F1E04B41E12h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4723AB second address: 4723B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4760C1 second address: 4760CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4760CA second address: 4760F1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1E04B472D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F1E04B472EAh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4760F1 second address: 4760F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4763AE second address: 4763B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4763B2 second address: 4763B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4763B8 second address: 4763C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1E04B472DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4764F9 second address: 476501 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F72A second address: 47F72E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F72E second address: 47F734 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F734 second address: 47F74F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1E04B472DDh 0x0000000b jo 00007F1E04B472DCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DD1F second address: 47DD23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DD23 second address: 47DD3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B472E1h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DD3F second address: 47DD50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b je 00007F1E04B41E06h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E571 second address: 47E57B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E57B second address: 47E57F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E57F second address: 47E583 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E583 second address: 47E589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E589 second address: 47E59D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jns 00007F1E04B472D6h 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47EB3E second address: 47EB48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1E04B41E06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47EB48 second address: 47EB4E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47EB4E second address: 47EB54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47EB54 second address: 47EB58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47EE26 second address: 47EE41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1E04B41E15h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47EE41 second address: 47EE4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F1E04B472D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47EE4C second address: 47EEA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1E04B41E16h 0x00000008 jnl 00007F1E04B41E06h 0x0000000e jmp 00007F1E04B41E19h 0x00000013 popad 0x00000014 ja 00007F1E04B41E0Eh 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e js 00007F1E04B41E0Eh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F185 second address: 47F1BA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1E04B472DEh 0x00000008 pushad 0x00000009 jnp 00007F1E04B472D6h 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007F1E04B472E2h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F1BA second address: 47F1C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F46D second address: 47F473 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48269D second address: 4826A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4826A3 second address: 4826D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1E04B472E9h 0x0000000a jl 00007F1E04B472D8h 0x00000010 pushad 0x00000011 popad 0x00000012 jp 00007F1E04B472DEh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482AFD second address: 482B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jnp 00007F1E04B41E0Ah 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482B17 second address: 482B26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jc 00007F1E04B472DEh 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482B26 second address: 482B41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F1E04B41E14h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482C6D second address: 482C82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1E04B472D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f js 00007F1E04B472D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4908CC second address: 4908D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F1E04B41E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4908D8 second address: 4908FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F1E04B472E6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d jo 00007F1E04B472DEh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490BDD second address: 490BE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490EC4 second address: 490EF8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F1E04B472DCh 0x00000011 jmp 00007F1E04B472DBh 0x00000016 popad 0x00000017 jmp 00007F1E04B472DDh 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49105D second address: 491094 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B41E10h 0x00000007 jmp 00007F1E04B41E0Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1E04B41E17h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 491094 second address: 49109E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49109E second address: 4910A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4910A4 second address: 4910A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4910A8 second address: 4910AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4910AC second address: 4910BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F1E04B472D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4910BA second address: 4910BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4911F4 second address: 4911FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4911FB second address: 491200 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 491200 second address: 491206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4915FE second address: 491619 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B41E14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49241B second address: 492438 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B472E7h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4955E8 second address: 4955ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 498EFC second address: 498F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 499077 second address: 49907D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49907D second address: 499083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A84BB second address: 4A84CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F1E04B41E06h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A84CB second address: 4A84D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A84D1 second address: 4A84DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A84DA second address: 4A84DF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A84DF second address: 4A84F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1E04B41E0Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A84F2 second address: 4A84F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB3E2 second address: 4AB3E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB253 second address: 4AB260 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB260 second address: 4AB266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADE5A second address: 4ADE5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ADE5E second address: 4ADE64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3317 second address: 4C332F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F1E04B472E2h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C332F second address: 4C3335 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C35EF second address: 4C35F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C35F5 second address: 4C35FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C376B second address: 4C37AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B472DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F1E04B472DEh 0x0000000f jp 00007F1E04B472ECh 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C37AB second address: 4C37B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3A74 second address: 4C3A7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F1E04B472D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3A7E second address: 4C3A92 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F1E04B41E0Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3A92 second address: 4C3AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1E04B472E1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3BB7 second address: 4C3BBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4574 second address: 4C4578 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4578 second address: 4C4590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1E04B41E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F1E04B41E0Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C723D second address: 4C726D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1E04B472E2h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1E04B472E5h 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C726D second address: 4C7271 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E4AC7 second address: 3E4AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2B31 second address: 4E2B3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F1E04B41E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E295D second address: 4E296E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F1E04B472DAh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E296E second address: 4E29AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F1E04B41E06h 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jng 00007F1E04B41E08h 0x00000014 push eax 0x00000015 pop eax 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jc 00007F1E04B41E10h 0x00000020 jmp 00007F1E04B41E0Ah 0x00000025 jmp 00007F1E04B41E16h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5683 second address: 4E568F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F1E04B472D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E568F second address: 4E569A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E569A second address: 4E569E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E569E second address: 4E56A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE3E6 second address: 4FE3EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE3EA second address: 4FE3EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE54A second address: 4FE550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE550 second address: 4FE55C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F1E04B41E06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE55C second address: 4FE575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F1E04B472DAh 0x0000000d jns 00007F1E04B472D6h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE575 second address: 4FE57A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE57A second address: 4FE592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1E04B472E1h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE592 second address: 4FE596 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FEAAF second address: 4FEAB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1E04B472D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FEE3F second address: 4FEE47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FEFF1 second address: 4FF035 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1E04B472FDh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F1E04B472D8h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pushad 0x00000015 jp 00007F1E04B472D6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF035 second address: 4FF03C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF03C second address: 4FF044 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF044 second address: 4FF04A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500AA2 second address: 500AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500AA8 second address: 500ABA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F1E04B41E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500ABA second address: 500AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500AC0 second address: 500ACB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5034A0 second address: 5034A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5036B9 second address: 503729 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1E04B41E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F1E04B41E08h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 mov edx, eax 0x0000002a mov edx, dword ptr [ebp+1248AA03h] 0x00000030 push 00000004h 0x00000032 xor edx, dword ptr [ebp+122D35E3h] 0x00000038 call 00007F1E04B41E09h 0x0000003d jmp 00007F1E04B41E17h 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 pushad 0x00000047 popad 0x00000048 ja 00007F1E04B41E06h 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503729 second address: 50372F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50372F second address: 50376D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F1E04B41E14h 0x00000011 mov eax, dword ptr [eax] 0x00000013 jmp 00007F1E04B41E0Eh 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jng 00007F1E04B41E06h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50376D second address: 503771 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503771 second address: 503777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503777 second address: 50377D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5039DE second address: 503A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F1E04B41E08h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 mov dh, 9Dh 0x00000024 push dword ptr [ebp+122D3549h] 0x0000002a push 00000000h 0x0000002c push esi 0x0000002d call 00007F1E04B41E08h 0x00000032 pop esi 0x00000033 mov dword ptr [esp+04h], esi 0x00000037 add dword ptr [esp+04h], 00000019h 0x0000003f inc esi 0x00000040 push esi 0x00000041 ret 0x00000042 pop esi 0x00000043 ret 0x00000044 jnc 00007F1E04B41E06h 0x0000004a push 18CC31FBh 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503A40 second address: 503A4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B472DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 505251 second address: 505257 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 506D43 second address: 506D65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B472E1h 0x00000007 jmp 00007F1E04B472DDh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090CC8 second address: 5090CE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov si, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test ecx, ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1E04B41E10h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090CE7 second address: 5090D42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B472DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F1E04B472FEh 0x0000000f jmp 00007F1E04B472E6h 0x00000014 add eax, ecx 0x00000016 jmp 00007F1E04B472E0h 0x0000001b mov eax, dword ptr [eax+00000860h] 0x00000021 jmp 00007F1E04B472E0h 0x00000026 test eax, eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090D42 second address: 5090D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090D46 second address: 5090D4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090D4C second address: 5090D97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1E04B41E14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F1E75527E01h 0x0000000f jmp 00007F1E04B41E10h 0x00000014 test byte ptr [eax+04h], 00000005h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F1E04B41E17h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090D97 second address: 5090D9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090D9D second address: 5090DA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42081A second address: 42081E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 420A3E second address: 420A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 2638EA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 49E448 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 4436	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3816	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2109320528.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108357594.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2109320528.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108357594.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2109173587.000000000119E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW}

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00245BB0 LdrInitializeThunk,

0_2_00245BB0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: spirittunek.stor
Source: file.exe	String found in binary or memory: bathdoomgaz.stor
Source: file.exe	String found in binary or memory: studennotediw.stor
Source: file.exe	String found in binary or memory: dissapoiznw.stor
Source: file.exe	String found in binary or memory: eaglepawnoy.stor
Source: file.exe	String found in binary or memory: mobbipenju.stor

Source: file.exe, file.exe, 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.ZPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
steamcommunity.com	0%	Virustotal	Browse
eaglepawnoy.store	14%	Virustotal	Browse
spirittunek.store	14%	Virustotal	Browse
licendfilteo.site	12%	Virustotal	Browse
mobbipenju.store	14%	Virustotal	Browse
studennotediw.store	14%	Virustotal	Browse
clearancek.site	14%	Virustotal	Browse
dissapoiznw.store	14%	Virustotal	Browse
bathdoomgaz.store	14%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://player.vimeo.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://steamcommunity.com/my/wishlist/	0%	Virustotal		Browse
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	0%	Virustotal		Browse
https://bathdoomgaz.store:443/api	14%	Virustotal		Browse
https://steamcommunity.com/?subsection=broadcasts	0%	Virustotal		Browse
https://steamcommunity.com/market/	0%	Virustotal		Browse
https://steamcommunity.com/discussions/	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	0%	Virustotal		Browse
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	0%	Virustotal		Browse
https://www.youtube.com	0%	Virustotal		Browse
https://clearancek.site:443/api	14%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz	0%	Virustotal		Browse
https://steamcommunity.com/workshop/	0%	Virustotal		Browse
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	0%	Virustotal		Browse
https://eaglepawnoy.store:443/api	14%	Virustotal		Browse
licendfilteo.site	12%	Virustotal		Browse
https://steamcommunity.com:443/profiles/76561199724331900	8%	Virustotal		Browse
clearancek.site	14%	Virustotal		Browse
https://steamcommunity.com/p	0%	Virustotal		Browse
https://www.youtube.com/	0%	Virustotal		Browse
https://mobbipenju.store:443/api	14%	Virustotal		Browse
https://steamcommunity.com	0%	Virustotal		Browse
https://steamcommunity.com/profiles/76561199724331900P	0%	Virustotal		Browse
https://sketchfab.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	104.102.49.254	true	false	0%, Virustotal, Browse	unknown
eaglepawnoy.store	unknown	unknown	false	14%, Virustotal, Browse	unknown
bathdoomgaz.store	unknown	unknown	false	14%, Virustotal, Browse	unknown
spirittunek.store	unknown	unknown	false	14%, Virustotal, Browse	unknown
licendfilteo.site	unknown	unknown	true	12%, Virustotal, Browse	unknown
studennotediw.store	unknown	unknown	false	14%, Virustotal, Browse	unknown
mobbipenju.store	unknown	unknown	false	14%, Virustotal, Browse	unknown
clearancek.site	unknown	unknown	true	14%, Virustotal, Browse	unknown
dissapoiznw.store	unknown	unknown	false	14%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
studennotediw.stor	true		unknown
spirittunek.stor	true		unknown
eaglepawnoy.stor	true		unknown
clearancek.site	true	14%, Virustotal, Browse	unknown
mobbipenju.stor	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
licendfilteo.site	true	12%, Virustotal, Browse	unknown
bathdoomgaz.stor	true		unknown
dissapoiznw.stor	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/my/wishlist/	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://player.vimeo.com	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	file.exe, 00000000.00000003.2108115469.0000000001241000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bathdoomgaz.store:443/api	file.exe, 00000000.00000003.2108202643.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true	14%, Virustotal, Browse	unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://steamcommunity.com/market/	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://store.steampowered.com/news/	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://licendfilteo.site:443/apiz	file.exe, 00000000.00000003.2108202643.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011D5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.youtube.com	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://store.steampowered.com/stats/	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://medal.tv	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011D5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://clearancek.site:443/api	file.exe, 00000000.00000003.2108202643.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true	14%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011D5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://s.ytimg.com;	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://login.steampowered.com/	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://eaglepawnoy.store:443/api	file.exe, 00000000.00000003.2108202643.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true	14%, Virustotal, Browse	unknown
https://store.steampowered.com/legal/	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steam.tv/	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/p	file.exe, 00000000.00000003.2108115469.0000000001241000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com:443/profiles/76561199724331900	file.exe, 00000000.00000003.2108202643.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	false	8%, Virustotal, Browse	unknown
https://store.steampowered.com/points/shop/	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011D5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://sketchfab.com	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://lv.queniujq.cn	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mobbipenju.store:443/api	file.exe, 00000000.00000003.2108202643.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true	14%, Virustotal, Browse	unknown
https://steamcommunity.com/profiles/76561199724331900P	file.exe, 00000000.00000002.2109320528.00000000011F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108357594.00000000011F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011EF000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse	unknown
https://www.youtube.com/	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://127.0.0.1:27060	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011D5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spirittunek.store:443/api	file.exe, 00000000.00000003.2108202643.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://studennotediw.store:443/apiI	file.exe, 00000000.00000003.2108202643.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109173587.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://help.steampowered.com/	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108202643.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/mobile	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	file.exe, 00000000.00000003.2108050811.0000000001257000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108050811.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	file.exe, 00000000.00000003.2108115469.0000000001241000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108316535.0000000001241000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2108170344.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	file.exe, 00000000.00000003.2108170344.000000000125B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527621
Start date and time:	2024-10-07 06:51:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@9/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:52:03	API Interceptor	4x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	23.197.127.21
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	maizu v1.4.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	AimBot.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	injcheat.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	setupa.exe	Get hash	malicious	GhostRat	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	104.102.49.254
	TVyKPaL2h0.exe	Get hash	malicious	Amadey	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946355312811186
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'878'016 bytes
MD5:	86d82964c577f6b26d904e4417b16178
SHA1:	e3711aa266bf13c33ab29678f8520594dc2dbf8d
SHA256:	b81c59ad55cdeb8b6003e41d467098a7395737c6cd72b5f57ee789fbdbff195b
SHA512:	f84803f0ad7d4bbc47ec72a4f469bb08ab0d83b884e013ee9da9b8cfbe3264c118ec995ea974caf2d9cb24134861b05ee3e5ae58b2bef06658c3de72a1dfba1f
SSDEEP:	49152:jx6XB2+ZADVAr6vQuGgT4LlHbf9NuQ9S38v:jx6XAzDGr6YFgOlHL9IQEsv
TLSH:	BA9533E98EB29E1ED864CDF0433ADB867607E61CB5F319096F1C63E4364A521E086C5F
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f............................. K...........@..........................PK.....(.....@.................................W...k..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8b2000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F1E045165BAh
jbe 00007F1E045165D2h
add byte ptr [eax], al
jmp 00007F1E045185B5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	ddd2363d923c648112030fc32b51fcc1	False	0.9994134179042904	data	7.97011971407078	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x60000	0x2b0000	0x200	4065ca9425bf25fc13f9042538b2f9a2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ncvybzci	0x310000	0x1a1000	0x1a1000	7dc3a9214c447e34f15fbdd8e25410c5	False	0.9940358260266786	data	7.952874075502727	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mdqgyexl	0x4b1000	0x1000	0x400	c57339d51c1ea235d3999efa5fe74d50	False	0.8056640625	data	6.304435236135454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4b2000	0x3000	0x2200	dd0782bff3bb560e392fe107f7d6302f	False	0.006433823529411764	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T06:52:04.799601+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.5	53012	1.1.1.1	53	UDP
2024-10-07T06:52:04.875367+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.5	63921	1.1.1.1	53	UDP
2024-10-07T06:52:04.893095+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.5	58230	1.1.1.1	53	UDP
2024-10-07T06:52:04.903486+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.5	56520	1.1.1.1	53	UDP
2024-10-07T06:52:05.071567+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.5	59877	1.1.1.1	53	UDP
2024-10-07T06:52:05.083993+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.5	49426	1.1.1.1	53	UDP
2024-10-07T06:52:05.096957+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.5	63789	1.1.1.1	53	UDP
2024-10-07T06:52:05.106926+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.5	59487	1.1.1.1	53	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 06:52:05.134277105 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 7, 2024 06:52:05.134309053 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 7, 2024 06:52:05.134382963 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 7, 2024 06:52:05.150487900 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 7, 2024 06:52:05.150504112 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 7, 2024 06:52:05.799490929 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 7, 2024 06:52:05.799716949 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 7, 2024 06:52:05.804027081 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 7, 2024 06:52:05.804043055 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 7, 2024 06:52:05.804445982 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 7, 2024 06:52:05.852721930 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 7, 2024 06:52:05.895478010 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 7, 2024 06:52:06.258829117 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 7, 2024 06:52:06.258886099 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 7, 2024 06:52:06.258929014 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 7, 2024 06:52:06.258946896 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 7, 2024 06:52:06.259015083 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 7, 2024 06:52:06.259129047 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 7, 2024 06:52:06.259129047 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 7, 2024 06:52:06.259147882 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 7, 2024 06:52:06.259202957 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 7, 2024 06:52:06.347899914 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 7, 2024 06:52:06.347976923 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 7, 2024 06:52:06.348007917 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 7, 2024 06:52:06.348022938 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 7, 2024 06:52:06.348052979 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 7, 2024 06:52:06.348069906 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 7, 2024 06:52:06.348113060 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 7, 2024 06:52:06.349668026 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 7, 2024 06:52:06.349682093 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 7, 2024 06:52:06.349692106 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 7, 2024 06:52:06.349697113 CEST	443	49704	104.102.49.254	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 06:52:04.799601078 CEST	53012	53	192.168.2.5	1.1.1.1
Oct 7, 2024 06:52:04.808342934 CEST	53	53012	1.1.1.1	192.168.2.5
Oct 7, 2024 06:52:04.875366926 CEST	63921	53	192.168.2.5	1.1.1.1
Oct 7, 2024 06:52:04.883984089 CEST	53	63921	1.1.1.1	192.168.2.5
Oct 7, 2024 06:52:04.893095016 CEST	58230	53	192.168.2.5	1.1.1.1
Oct 7, 2024 06:52:04.901480913 CEST	53	58230	1.1.1.1	192.168.2.5
Oct 7, 2024 06:52:04.903486013 CEST	56520	53	192.168.2.5	1.1.1.1
Oct 7, 2024 06:52:04.912538052 CEST	53	56520	1.1.1.1	192.168.2.5
Oct 7, 2024 06:52:05.071567059 CEST	59877	53	192.168.2.5	1.1.1.1
Oct 7, 2024 06:52:05.080257893 CEST	53	59877	1.1.1.1	192.168.2.5
Oct 7, 2024 06:52:05.083992958 CEST	49426	53	192.168.2.5	1.1.1.1
Oct 7, 2024 06:52:05.095889091 CEST	53	49426	1.1.1.1	192.168.2.5
Oct 7, 2024 06:52:05.096956968 CEST	63789	53	192.168.2.5	1.1.1.1
Oct 7, 2024 06:52:05.105705023 CEST	53	63789	1.1.1.1	192.168.2.5
Oct 7, 2024 06:52:05.106925964 CEST	59487	53	192.168.2.5	1.1.1.1
Oct 7, 2024 06:52:05.115804911 CEST	53	59487	1.1.1.1	192.168.2.5
Oct 7, 2024 06:52:05.118135929 CEST	54940	53	192.168.2.5	1.1.1.1
Oct 7, 2024 06:52:05.125221968 CEST	53	54940	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 06:52:04.799601078 CEST	192.168.2.5	1.1.1.1	0xb76e	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:52:04.875366926 CEST	192.168.2.5	1.1.1.1	0x687a	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:52:04.893095016 CEST	192.168.2.5	1.1.1.1	0x9bf1	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:52:04.903486013 CEST	192.168.2.5	1.1.1.1	0x1639	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:52:05.071567059 CEST	192.168.2.5	1.1.1.1	0xbf1a	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:52:05.083992958 CEST	192.168.2.5	1.1.1.1	0x5e29	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:52:05.096956968 CEST	192.168.2.5	1.1.1.1	0xc3b4	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:52:05.106925964 CEST	192.168.2.5	1.1.1.1	0x2b39	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:52:05.118135929 CEST	192.168.2.5	1.1.1.1	0x4823	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 06:52:04.808342934 CEST	1.1.1.1	192.168.2.5	0xb76e	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:52:04.883984089 CEST	1.1.1.1	192.168.2.5	0x687a	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:52:04.901480913 CEST	1.1.1.1	192.168.2.5	0x9bf1	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:52:04.912538052 CEST	1.1.1.1	192.168.2.5	0x1639	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:52:05.080257893 CEST	1.1.1.1	192.168.2.5	0xbf1a	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:52:05.095889091 CEST	1.1.1.1	192.168.2.5	0x5e29	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:52:05.105705023 CEST	1.1.1.1	192.168.2.5	0xc3b4	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:52:05.115804911 CEST	1.1.1.1	192.168.2.5	0x2b39	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:52:05.125221968 CEST	1.1.1.1	192.168.2.5	0x4823	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.102.49.254	443	6728	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 04:52:05 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-07 04:52:06 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 07 Oct 2024 04:52:06 GMT Content-Length: 25489 Connection: close Set-Cookie: sessionid=87e8c62e176ffbfb40e2f3ad; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-07 04:52:06 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-07 04:52:06 UTC	10975	IN	Data Raw: 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 74 68 61 69 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 68 61 69 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e0 b9 84 e0 b8 97 e0 b8 a2 20 28 54 68 61 69 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 62 75 6c 67 61 72 69 61 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 62 75 6c 67 61 72 69 61 6e 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 Data Ascii: <a class="popup_menu_item tight" href="?l=thai" onclick="ChangeLanguage( 'thai' ); return false;"> (Thai)</a><a class="popup_menu_item tight" href="?l=bulgarian" onclick="ChangeLanguage( 'bulgarian' ); return fa

Target ID:	0
Start time:	00:52:01
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x200000
File size:	1'878'016 bytes
MD5 hash:	86D82964C577F6B26D904E4417B16178
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	66.7%
Total number of Nodes:	36
Total number of Limit Nodes:	4

Executed Functions

Function 0020FCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

V, xrefs: 0020FEDC
VY^_, xrefs: 0020FDFF
t, xrefs: 0020FCBE
J|BJ, xrefs: 0021000D

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: aae9ea9fca2e1db1a868acf2f3d4af073cf430c6ef565ca7eecaa0bc998a36b0
Instruction ID: 119371aaaefdaba7d5796a271d49d26d5224fcbdcc41ae7d44cd89362dfebde2
Opcode Fuzzy Hash: aae9ea9fca2e1db1a868acf2f3d4af073cf430c6ef565ca7eecaa0bc998a36b0
Instruction Fuzzy Hash: E3D1997452C381ABD320DF14C59476FBBE1ABA6744F14882CF4C88B252D375CDA9DB92

Function 0020D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 0020D2F1

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: cb2710ac14e311471b75b087305e08f5bd568bd0d66b53006b37327527676151
Instruction ID: ed91823e14a6dee4b48be79de96df23d8aa7e020d643e85baccb6d46ec8804e3
Opcode Fuzzy Hash: cb2710ac14e311471b75b087305e08f5bd568bd0d66b53006b37327527676151
Instruction Fuzzy Hash: 8A41227452E380ABC701AFA8D594A2EFBE5AF52704F148C0CE9C497293C336D8649B67

Function 00245BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0024973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00245BDE

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 0024695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 002469C5

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 5356ca9708e8efc0d9991545976d460a1050952bc082a2adf213a5b33cfb6587
Instruction ID: 1fb6da30f546609da20e7fff0d40cc7b608af1912496c0c4c8c7573c22c566fd
Opcode Fuzzy Hash: 5356ca9708e8efc0d9991545976d460a1050952bc082a2adf213a5b33cfb6587
Instruction Fuzzy Hash: E231C9B05283128FD718EF14D8A872BB7F1FF8A345F08981CE5C6972A1E3749924CB56

Function 0021049B Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f8dd70f0cddaa4872a984cdcbbbe90aa2217b4d60755bd3f579df1649b6ecd2
Instruction ID: f6221c93b67ea0a7843205896bf1d364f427e9ec9a65feea61519c8836b5985c
Opcode Fuzzy Hash: 0f8dd70f0cddaa4872a984cdcbbbe90aa2217b4d60755bd3f579df1649b6ecd2
Instruction Fuzzy Hash: 6491AC75210B00DFD324CF25E898A27B7F6FF8A314B118A6CE8568BAA1D770F855CB50

Function 00210228 Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5434ad3190ba46fdc0423e3e28dc1af79eaad3413e5c8768564453ac05d14932
Instruction ID: ba0e5e44496851a449c14f31ea242db324bb930b421b28eb21a89c7fa61fc870
Opcode Fuzzy Hash: 5434ad3190ba46fdc0423e3e28dc1af79eaad3413e5c8768564453ac05d14932
Instruction Fuzzy Hash: 46717A78210701DFD7248F21E898B27B7F6FF8A315F108968E8968B662D771A865CB50

Function 002499D0 Relevance: .1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 136bf970775e4075e5431383d638b41616a6f92f039c4f86eea6988a11829d4d
Instruction ID: 78be3f583c5fe9ca38fb558f9b083e0e6b1725b18141a49902ae1d56edcd2c3f
Opcode Fuzzy Hash: 136bf970775e4075e5431383d638b41616a6f92f039c4f86eea6988a11829d4d
Instruction Fuzzy Hash: A141A134228311ABD718DF15E894B2BF7E5EB89714F14882CF5CA97251D331EC61CB66

Function 002463B8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b8cf719f44d1c8ddf93faf534bc1337673ddafef07c41f6396af24f9e426e270
Instruction ID: 7d0083f5dd7971209503330657fc39b3c6c1eb17429f0a1e89ccc3409ff6b457
Opcode Fuzzy Hash: b8cf719f44d1c8ddf93faf534bc1337673ddafef07c41f6396af24f9e426e270
Instruction Fuzzy Hash: 5B310670219302BBDA28DF04DD89F3AB7A5FB86B51F64450CF1C15B2D1D370A8208B56

Function 00243220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 002432A6

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 1a84cf4740a2ccb6b2455039be36d0dbcd5c50e10a10891ce229e8679cafd0cb
Instruction ID: 7f74dbb3d179005fcb6b4f9f2ed8d6bfcff38480b81e3da16c2b1b3b3272b4d8
Opcode Fuzzy Hash: 1a84cf4740a2ccb6b2455039be36d0dbcd5c50e10a10891ce229e8679cafd0cb
Instruction Fuzzy Hash: 16016D3450D350ABC705EF18E849A1ABBE8EF4AB01F054D5CE5C58B361D335DD60CB96

Function 00243202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00243208

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7f29a2d9f95b246d10c6b981ed5efad992ac64c3f8d8c436f915e02990be8fe6
Instruction ID: 5ab0b748918172f7236d247dcc3a5345a30708495eab4c69df965dc81e466776
Opcode Fuzzy Hash: 7f29a2d9f95b246d10c6b981ed5efad992ac64c3f8d8c436f915e02990be8fe6
Instruction Fuzzy Hash: 85B012300901005FDA141B00FC0EF003510EB00606F800050A100040B1D1715864C559

Non-executed Functions

Function 0021DB6F Relevance: 32.0, Strings: 24, Instructions: 2006COMMON

Download Yara Rule

Strings

LKJI, xrefs: 0021E6E6
`Y^_, xrefs: 0021E99E
<=:;, xrefs: 0021E930
tsrq, xrefs: 0021E6FC
AR, xrefs: 0021DD10
dcba, xrefs: 0021E728
@ONM, xrefs: 0021E6DB
tuJK, xrefs: 0021E967
D, xrefs: 0021E846
%*+(, xrefs: 0021DE37, 0021DE46
xgfe, xrefs: 0021E71D
QNOL, xrefs: 0021E775
:WUE, xrefs: 0021F6B7, 0021F6C6
WP, xrefs: 0021DCEF
()./, xrefs: 0021E9CA
lkji, xrefs: 0021E73E
|, xrefs: 0021ECB1
`onm, xrefs: 0021E733
DCBA, xrefs: 0021E887, 0021E896
T, xrefs: 0021F157
89>?, xrefs: 0021E9F6
<=2, xrefs: 0021EA01
89&', xrefs: 0021E93B
mjkh, xrefs: 0021E7D8

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 2994545307-1418943773
Opcode ID: 706e0a53a18ae2025e3213313cd4c120e7263c48006fdd9c84331e0189cee890
Instruction ID: 54e257d8f0874f0ff4cfbf16ffb917e804aa8be0050d7911d25e223d6d1a10b5
Opcode Fuzzy Hash: 706e0a53a18ae2025e3213313cd4c120e7263c48006fdd9c84331e0189cee890
Instruction Fuzzy Hash: 1BF289B05183829BD770CF14C884BEBBBE6BFE5304F54482CE8D98B251D77199A5CB92

Function 002323E0 Relevance: 31.3, APIs: 4, Strings: 12, Instructions: 3298COMMON

Download Yara Rule

Strings

aenQ, xrefs: 0023276A
|}&C, xrefs: 00232F21
:, xrefs: 002332DD
3<, xrefs: 002332D6
f@~!, xrefs: 002325FF
ggxz, xrefs: 00232685
mlc@, xrefs: 0023275C
Cx, xrefs: 0023453D
{l`~, xrefs: 0023268C
`tii, xrefs: 00232693
fedc, xrefs: 00232782
%*+(, xrefs: 002340EF

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: %*+($3<$:$Cx$`tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~$|}&C
API String ID: 0-786070067
Opcode ID: 1dad884a4311f6677abb1ce5bef4e878d896b7208a628a667af8c1c95ca8573b
Instruction ID: 759355384eb976016cb86176ecd8b47c862f1f5be6e55d989483d9c1dcfd22c2
Opcode Fuzzy Hash: 1dad884a4311f6677abb1ce5bef4e878d896b7208a628a667af8c1c95ca8573b
Instruction Fuzzy Hash: C333BCB0524B81CBD725CF38C590762BBE1BF16304F58899DE4DA8BA82C735F916CB61

Function 00229F62 Relevance: 21.7, Strings: 17, Instructions: 473COMMON

Download Yara Rule

Strings

WQ, xrefs: 0022A62B
kW, xrefs: 0022A380
?m,o, xrefs: 0022A13C
Gt, xrefs: 00229FF8
N[, xrefs: 0022A375
CG, xrefs: 0022AA32
hi, xrefs: 0022AB9D
WH, xrefs: 0022AA1C
S], xrefs: 0022A636
JG, xrefs: 0022AA27
%e6g, xrefs: 0022A152
]{, xrefs: 0022A1E7, 0022A1F3
sm, xrefs: 0022A830
=], xrefs: 0022A36A
_Y, xrefs: 0022A641
(a*c, xrefs: 0022A147
/), xrefs: 0022A66D

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: c8665174b88923b581b03c441e96163e2541acc92e2609317cc250cb51b5ad1b
Instruction ID: d825902d1c384a5bfc8ae842c0a167ce2c1fbd50e11a3cec8f8579df21e9bea8
Opcode Fuzzy Hash: c8665174b88923b581b03c441e96163e2541acc92e2609317cc250cb51b5ad1b
Instruction Fuzzy Hash: 7552C6B440D385CAE270CF65E581B8EBAF1BB92740F608A1DE5ED9B255DBB08045CF93

Function 00229510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

B7U1, xrefs: 00229AFB
z=Q?, xrefs: 00229826
T#a-, xrefs: 00229AE3
!E4G, xrefs: 00229836
?M0K, xrefs: 00229968
L3Y=, xrefs: 00229B03
O+f), xrefs: 00229634, 0022963D
8;, xrefs: 00229B13
;IJK, xrefs: 0022983E
pq, xrefs: 002299E0
G'M!, xrefs: 00229ADB
X/R), xrefs: 00229AEB
G+X5, xrefs: 00229AF3
2A"_, xrefs: 00229980
,A&C, xrefs: 0022982E
B?Q9, xrefs: 00229B0B

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: 179850558c2292a5498bb949dd138d71a3cf637e894540fc98a2b04ac6e89f3a
Instruction ID: 6f6d7c55c0c36ef57fe6c12a928bf6fc5dc382ff7adfc2ab33ebe76a519db256
Opcode Fuzzy Hash: 179850558c2292a5498bb949dd138d71a3cf637e894540fc98a2b04ac6e89f3a
Instruction Fuzzy Hash: BEF15FB0528381ABD310DF95E880A2BBBF4FB8AB48F544D0CF4D59B252D374D958CB96

Function 0022DD29 Relevance: 18.6, Strings: 14, Instructions: 1142COMMON

Download Yara Rule

Strings

r", xrefs: 0022E92E
", xrefs: 0022E9C5
{E, xrefs: 0022E323
upH}, xrefs: 0022DE8A, 0022E798, 0022DF4A
-M2O, xrefs: 0022E25A
hX]N, xrefs: 0022DDC7
<Y.[, xrefs: 0022E27D
%*+(, xrefs: 0022E143
,Q?S, xrefs: 0022E26F
=]+_, xrefs: 0022E276
)IgK, xrefs: 0022E261
n\+H, xrefs: 0022DDC0
Y9N;, xrefs: 0022E245
", xrefs: 0022E403, 0022E664, 0022E7BD

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: "$%*+($)IgK$,Q?S$-M2O$<Y.[$=]+_$Y9N;$hX]N$n\+H$r"$upH}${E$"
API String ID: 0-869478845
Opcode ID: 697436ed65de22bfeea9dd123eea43e708a901e5a1487748d20f18706c01a604
Instruction ID: 370188def99e2ea9ec1fe27b24a458620eeef2e0eecf23c85a398fc866dca787
Opcode Fuzzy Hash: 697436ed65de22bfeea9dd123eea43e708a901e5a1487748d20f18706c01a604
Instruction Fuzzy Hash: E99236B1E10215DFDB18CFA8E85176EBBB2FF49310F294268D455AB391D7319D21CB90

Function 003D2A50 Relevance: 15.3, Strings: 11, Instructions: 1537COMMON

Download Yara Rule

Strings

"VoK, xrefs: 003D3CBA
/&ow, xrefs: 003D3704
`X=, xrefs: 003D2D24
VW}, xrefs: 003D2E24
Q, xrefs: 003D3594
7c[7, xrefs: 003D2A87
-k_o, xrefs: 003D3B4B
}^su, xrefs: 003D330C
@0o, xrefs: 003D3520
2ao, xrefs: 003D3583
^w[, xrefs: 003D3030

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: "VoK$-k_o$/&ow$7c[7$@0o$Q$VW}$^w[$`X=$}^su$2ao
API String ID: 0-4180202552
Opcode ID: d43dbcb754c11fc1e015a31d3ec216345408ac9b65cb4001d5dd9ca86f11d815
Instruction ID: 873009110567c4c4e15001ba7722ab9c1d69039fe46a096562b4e697dae69c01
Opcode Fuzzy Hash: d43dbcb754c11fc1e015a31d3ec216345408ac9b65cb4001d5dd9ca86f11d815
Instruction Fuzzy Hash: 4FB2D5F360C2049FE304AF29EC8567AFBE5EFD4720F16492DEAC483744E63598458A97

Function 003DE5CB Relevance: 11.7, Strings: 8, Instructions: 1652COMMON

Download Yara Rule

Strings

Kev\, xrefs: 003DEFDE
:Q, xrefs: 003DF2CF
0~o{, xrefs: 003DF759
:gQ{, xrefs: 003DF79F
|*3}, xrefs: 003DE8BF
0bk, xrefs: 003DE79E
`yy, xrefs: 003DF4C5
qogd, xrefs: 003DF6E6

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: 0~o{$0bk$:gQ{$:Q$Kev\$`yy$qogd$|*3}
API String ID: 0-4264630112
Opcode ID: 802afff1f7e9c8e342a6bab747363e2832adcba0b374a8c3dca5e9dfea7ffce8
Instruction ID: ee94360ad3f4ae5c07e2aed6dcfc4a7861b59820904e8c18b5e892c4d03ec185
Opcode Fuzzy Hash: 802afff1f7e9c8e342a6bab747363e2832adcba0b374a8c3dca5e9dfea7ffce8
Instruction Fuzzy Hash: 6EB228F36082009FE704AE2DDC8577ABBE5EF94320F1A493DEAC5C7744EA3598058696

Function 0022098B Relevance: 10.8, Strings: 8, Instructions: 836COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00220A77, 00220A86
gce/, xrefs: 00221073
qrqp, xrefs: 00221089
{, xrefs: 00221502
cah`, xrefs: 0022107E
9.5^, xrefs: 00220F9F
&> &, xrefs: 00220F89
,#15, xrefs: 00220F94

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: %*+($&> &$,#15$9.5^$cah`$gce/$qrqp${
API String ID: 0-4102007303
Opcode ID: f102a0b16b1bd5e699a4e2ba9bf72ea7577c02267f21830a0f8e189ff4cac7cb
Instruction ID: 104f90eb59ec32ea09691973326d85448a6a72b3870a7586b7fec840a1782dbe
Opcode Fuzzy Hash: f102a0b16b1bd5e699a4e2ba9bf72ea7577c02267f21830a0f8e189ff4cac7cb
Instruction Fuzzy Hash: 8062B9B16183919BD330CF14E895BABB7E1FF96314F04492DE49A8B682E3759860CF53

Function 00201000 Relevance: 10.5, Strings: 7, Instructions: 1785COMMON

Download Yara Rule

Strings

-, xrefs: 002021ED
0123456789abcdefxp, xrefs: 00201587, 002015F8
gfff, xrefs: 00202297
0123456789ABCDEFXP, xrefs: 0020157D, 002015EB
@, xrefs: 00202C40
gfff, xrefs: 002022E1
gfff, xrefs: 00202226

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff
API String ID: 0-2517803157
Opcode ID: 9318855c9843a1d892c318ed4593778ed8c1fe3a9e06c06d3df92ba914c61d0a
Instruction ID: ba520e4784a0c07ec5b4dc1a3d83b3f58a912fec113f63d8b8e32e5b0567e3a6
Opcode Fuzzy Hash: 9318855c9843a1d892c318ed4593778ed8c1fe3a9e06c06d3df92ba914c61d0a
Instruction Fuzzy Hash: F0D217716283428FD718CE28C49436ABBE2AFD9314F18862DE499C73D2D774DD59CB82

Function 003E3562 Relevance: 10.4, Strings: 7, Instructions: 1600COMMON

Download Yara Rule

Strings

[CJg, xrefs: 003E4597
3V+x, xrefs: 003E43C2
WZ<W, xrefs: 003E3C9C
2}, xrefs: 003E39A1
UU:, xrefs: 003E3649
3], xrefs: 003E44D9
Ju7, xrefs: 003E3941

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: 2}$3V+x$Ju7$UU:$WZ<W$[CJg$3]
API String ID: 0-2742686546
Opcode ID: 1a9ad6f428e9c7861792cb681cdc2e5663e66700569696d668e33185887a3c11
Instruction ID: f93a67fa3fb91786aff9024f4e584b60461dca850d7c9332dd5e3e726132fc80
Opcode Fuzzy Hash: 1a9ad6f428e9c7861792cb681cdc2e5663e66700569696d668e33185887a3c11
Instruction Fuzzy Hash: F9B219F36082049FE3046F2DEC8567AFBE9EF94720F1A4A3DEAC583744E63558058796

Function 003E6AED Relevance: 9.1, Strings: 6, Instructions: 1623COMMON

Download Yara Rule

Strings

gfoW, xrefs: 003E7C6B
W?W, xrefs: 003E731B
z7n, xrefs: 003E6B9A
?k:|, xrefs: 003E732A
WwO{, xrefs: 003E764A
//, xrefs: 003E7B76

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: ?k:|$WwO{$W?W$gfoW$z7n$//
API String ID: 0-1352713576
Opcode ID: 67d274eb4a7cedcdcce187a4e0ae9fbe40d0e4f0ff153375bb990c2a0c97822c
Instruction ID: 52d281365595540eac6818d2d6e91a06dfc854c6dd9961211e56873c7e515830
Opcode Fuzzy Hash: 67d274eb4a7cedcdcce187a4e0ae9fbe40d0e4f0ff153375bb990c2a0c97822c
Instruction Fuzzy Hash: 67B217F3A0C6009FE704AE2DEC8567ABBE9EF94320F1A453DE6C4C3744EA3558458697

Function 003CE081 Relevance: 8.7, Strings: 6, Instructions: 1170COMMON

Download Yara Rule

Strings

kYv, xrefs: 003CE674
$ywo, xrefs: 003CE395
g*a4, xrefs: 003CECF1
,ew_, xrefs: 003CE69E
cgK, xrefs: 003CE470
\l?, xrefs: 003CE8AC

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: $ywo$,ew_$g*a4$kYv$\l?$cgK
API String ID: 0-1570074167
Opcode ID: baa5c7c89bb1f6d92632c7a12ca95f37e9c65e0357fd545a51a9b8269c32b1a7
Instruction ID: 91d75408b56ef0a458be0ff8801f9a710f4db0e43d84404dcde98bb78dc9a95e
Opcode Fuzzy Hash: baa5c7c89bb1f6d92632c7a12ca95f37e9c65e0357fd545a51a9b8269c32b1a7
Instruction Fuzzy Hash: C272F9F36081009FE304AE2DEC8567ABBE9EF94320F1A493DEAC5D3344E63598158797

Function 003E5003 Relevance: 8.0, Strings: 5, Instructions: 1709COMMON

Download Yara Rule

Strings

Adws, xrefs: 003E5658
M@, xrefs: 003E5EF6
q}9?, xrefs: 003E5D2C
T|?, xrefs: 003E5183
':ue, xrefs: 003E52FD

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: ':ue$Adws$M@$T|?$q}9?
API String ID: 0-2847461496
Opcode ID: 1b6e96b040e748bbab15f33c53e41368b07b646da70169476eaec942fc37cb36
Instruction ID: c43d1d70319e5c111e4273b1365a2c7f214270eb7bbd29a008978929d821b3f6
Opcode Fuzzy Hash: 1b6e96b040e748bbab15f33c53e41368b07b646da70169476eaec942fc37cb36
Instruction Fuzzy Hash: 79B24BF3A082149FE304AE2DEC8567AFBD9EF94320F1A453DEAC4D7744E93598018697

Function 003DAFB0 Relevance: 7.9, Strings: 5, Instructions: 1677COMMON

Download Yara Rule

Strings

oq~?, xrefs: 003DBCD5
)tN, xrefs: 003DBD5E
b;{/, xrefs: 003DB549
wv, xrefs: 003DB584
k><, xrefs: 003DBED7

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: k><$)tN$b;{/$oq~?$wv
API String ID: 0-3874430659
Opcode ID: 8edcb3b71a73e4ae627965c04851d18e3649bccbd8063bedab0b2c7127d151a6
Instruction ID: a81c0d73f8710587d1f8f4dc141f3baba0267e244eae0b48c72dbfaab882da23
Opcode Fuzzy Hash: 8edcb3b71a73e4ae627965c04851d18e3649bccbd8063bedab0b2c7127d151a6
Instruction Fuzzy Hash: 7BB237F3A0C204AFE3046E2DEC8567BFBE9EF94620F1A453DEAC5C3744E97558058692

Function 003D4500 Relevance: 7.7, Strings: 5, Instructions: 1499COMMON

Download Yara Rule

Strings

K"T, xrefs: 003D4D1A
5y}~, xrefs: 003D4BD0
`B#?, xrefs: 003D4B32
p?, xrefs: 003D4899
Qbyn, xrefs: 003D4E74

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: 5y}~$K"T$Qbyn$`B#?$p?
API String ID: 0-1673617620
Opcode ID: 02e3663e3d0a9320c768d6efd3b18ac05364e8c0dedc0cb49bd73bbb6420b195
Instruction ID: 17d348dd524d6ae608f6bd18a5f5f2c733b9a25da216d4f3c8ca42c9b20d6220
Opcode Fuzzy Hash: 02e3663e3d0a9320c768d6efd3b18ac05364e8c0dedc0cb49bd73bbb6420b195
Instruction Fuzzy Hash: 8CA2E5F3A0C2009FE3046E29EC8567ABBE5EF94720F1A493DEAC4C7744E63598448697

Function 002012F7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

0, xrefs: 00201DC1
0, xrefs: 0020243E
@, xrefs: 00203531
i, xrefs: 002028EA
0, xrefs: 00201E88

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 63041ab38527c8acfc972bbeba7054b3c44f6d3e367fab780bc7bf917b13c9c9
Instruction ID: 13c1df113cd38917f75e7356b99f3b355a7f1beb0ec303c29b65122c06c75f94
Opcode Fuzzy Hash: 63041ab38527c8acfc972bbeba7054b3c44f6d3e367fab780bc7bf917b13c9c9
Instruction Fuzzy Hash: 4C62F47162C3828FD318CF28C49476ABBE1AFD5304F188A5EE8D9872D2D774D959CB42

Function 0020164F Relevance: 6.7, Strings: 5, Instructions: 472COMMON

Download Yara Rule

Strings

gfff, xrefs: 00201F3C
0123456789abcdefxp, xrefs: 00201659
+, xrefs: 00201573
0123456789ABCDEFXP, xrefs: 0020164F
gfff, xrefs: 00201F57

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-1123320326
Opcode ID: 21256765553dd25f863ef2ce76bc4f7e49faa139bd9ffdf8d5b7656f9a81aad4
Instruction ID: e1876aa40f1005e39980495c0a3aa258850be4484c96807017fc4bffdb7d7ecd
Opcode Fuzzy Hash: 21256765553dd25f863ef2ce76bc4f7e49faa139bd9ffdf8d5b7656f9a81aad4
Instruction Fuzzy Hash: FDF1943161C3928FC715CF28C48435AFBE2ABD9304F188A6EE4D987392D774D959CB92

Function 002013A3 Relevance: 6.6, Strings: 5, Instructions: 390COMMON

Download Yara Rule

Strings

gfff, xrefs: 00201F3C
0123456789abcdefxp, xrefs: 002013AD
0123456789ABCDEFXP, xrefs: 002013A3
gfff, xrefs: 00201F57
-, xrefs: 00201F23

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: 816d197bb003b24ce1a65ed9501cdd731b91b6293fab6bc71638cad81caa11e3
Instruction ID: 92b15fe6d2d407b0cbd6b178da6272a8d208362c71d370c1ad95086bc33d6910
Opcode Fuzzy Hash: 816d197bb003b24ce1a65ed9501cdd731b91b6293fab6bc71638cad81caa11e3
Instruction Fuzzy Hash: D7D1A33161C7828FC715CE29C48426AFFE2AFD9304F18CA6EE4D987392D634D959CB52

Function 003E1B41 Relevance: 6.6, Strings: 4, Instructions: 1601COMMON

Download Yara Rule

Strings

84<&, xrefs: 003E2DBB
0z, xrefs: 003E1BD3
Bt}, xrefs: 003E2AB9
G;W, xrefs: 003E2602

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: 0z$84<&$Bt}$G;W
API String ID: 0-1174412863
Opcode ID: a389f4d6a20a9355ab8a4b8777ef8a0cf409554c0f73c690918b0d3b888285d7
Instruction ID: ad79416cbe3a8a186821180833e779327c432d30a2327f2ebc239d9246b109d6
Opcode Fuzzy Hash: a389f4d6a20a9355ab8a4b8777ef8a0cf409554c0f73c690918b0d3b888285d7
Instruction Fuzzy Hash: 34B2D4F3A0C2109FD3046E2DEC8566ABBE9EFD4720F1A893DE6C4D3744E63598058697

Function 003E0419 Relevance: 6.3, Strings: 4, Instructions: 1348COMMON

Download Yara Rule

Strings

&^]{, xrefs: 003E0AF3
k&k;, xrefs: 003E1259
Sl), xrefs: 003E0E67
=?K, xrefs: 003E0EBA

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: &^]{$=?K$Sl)$k&k;
API String ID: 0-214058118
Opcode ID: 6b862cb39f0f56b4e417d6a44277141403231cb98081d596b104fe081145e09b
Instruction ID: 95da50e7e9442583ca1398730ec512ef96e23e96ef54ebcde10995ff0e583e8a
Opcode Fuzzy Hash: 6b862cb39f0f56b4e417d6a44277141403231cb98081d596b104fe081145e09b
Instruction Fuzzy Hash: 3B9209F3A0C2049FE3046E29EC8567AF7E9EF94720F1A853DEAC4C3744EA7558058796

Function 0022FD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

m1s3, xrefs: 0022FEC3, 0022FECB
:, xrefs: 00230087
uvw, xrefs: 0022FE95
NA_I, xrefs: 0023036D

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: 22c27a7d7c132271b1a223435a6cb84efdbc4dabe491cc932a6a1b40705d8790
Instruction ID: e1db276af45338b2a7ef09c6c2637af65413b5756ecd07d85fe055e3d2fe4ab1
Opcode Fuzzy Hash: 22c27a7d7c132271b1a223435a6cb84efdbc4dabe491cc932a6a1b40705d8790
Instruction Fuzzy Hash: 5F32CAB0528381DFD305DF28E890B2BBBE5AB89300F144A6CF5D58B292D335D925CF66

Function 003D9389 Relevance: 5.5, Strings: 3, Instructions: 1706COMMON

Download Yara Rule

Strings

Gf5, xrefs: 003DA474
Y_, xrefs: 003D96FC
$j~, xrefs: 003DA7AE

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: Y_$$j~$Gf5
API String ID: 0-329047318
Opcode ID: 41bacf16e3e46e8b8e396cee843614b1c200d8e8a9242e628e71298b62f22039
Instruction ID: ac379e47d308428de5755faa9ba5d3d71c71b6efc6e1674514ae8809c3b85381
Opcode Fuzzy Hash: 41bacf16e3e46e8b8e396cee843614b1c200d8e8a9242e628e71298b62f22039
Instruction Fuzzy Hash: 0AB228F3A0C2149FE304AE2DEC8567ABBE5EF98320F1A463DE6C5C7744E93558018696

Function 00213BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

p, xrefs: 00213C80
ss, xrefs: 00213C79
%*+(, xrefs: 00213EC4
;z, xrefs: 00213C87

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: a66c27c5fb7dc6d7fd3537b0ce34f572e449e337531afcdb565464631d2d0971
Instruction ID: d4fb6078ffd4531b3a276505b6dd6c80dff56c5822eb66100566dd0bb3a98b34
Opcode Fuzzy Hash: a66c27c5fb7dc6d7fd3537b0ce34f572e449e337531afcdb565464631d2d0971
Instruction Fuzzy Hash: 4C025BB4820B00DFD760EF24D986756BFF5FB16300F50495DE89A8B686D330A469CFA2

Function 00222260 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

lc, xrefs: 00222507
sj, xrefs: 00222327
a|, xrefs: 00222317
hu, xrefs: 0022232F

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: a4558dbc0d327725fde45d8749c10ccffad739867d0084858c88e16ea2b6355a
Instruction ID: c1790972ed442ad44bd77184520947f08b1f036e01a0917aef760513975f1c1f
Opcode Fuzzy Hash: a4558dbc0d327725fde45d8749c10ccffad739867d0084858c88e16ea2b6355a
Instruction Fuzzy Hash: 13A1CE70418351EBC320DF58D891A2BB7F0FF95354F548A0CE8D59B2A1E33AD964CB92

Function 0022D7AF Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

KV, xrefs: 0022D97D
CV, xrefs: 0022D98B
#', xrefs: 0022D9EA
T>, xrefs: 0022D984

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: b1534548e540628e3decb853f45ae31a7e173f9f4c546cee71e8bcde0a7945ec
Instruction ID: 23d790cfef0a0e436a5591e5b5b36e84ae7ea14122e62fa7e0ebd0016288fce5
Opcode Fuzzy Hash: b1534548e540628e3decb853f45ae31a7e173f9f4c546cee71e8bcde0a7945ec
Instruction Fuzzy Hash: EF8155F4811745ABCB20DFA5D28515EBFB1FF16300F60460CE4866BA55C330AA65CFE2

Function 0022AC91 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

,{*y, xrefs: 0022AD07, 0022AD13
(g6e, xrefs: 0022ACA1
lk, xrefs: 0022ACBC
4c2a, xrefs: 0022ACA9

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: 99b034a250956dc5fdd7024deb1d53e4b3d6e37930e117a2fa9c7b7233b7b215
Instruction ID: 33b89ecf928041d807b0c8569d7db4c3ba324a62e851e037d8dc1347aba72234
Opcode Fuzzy Hash: 99b034a250956dc5fdd7024deb1d53e4b3d6e37930e117a2fa9c7b7233b7b215
Instruction Fuzzy Hash: C241A8B4418382DBD7209F20E804BABB7F4FF86306F54595DE9C897260DB31D954CB9A

Function 0022C470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0022C9E4, 0022C9ED
~/i!, xrefs: 0022C537
%*+(, xrefs: 0022C8C3, 0022C8CB

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: 1b4a32f99686ad8e8552b21601a9740773d8011b740ad22497235cd9a2c5f2a2
Instruction ID: 95fe27a02720a1cead0cc910657bbcacd920cb092c4aa09c08dedc65080811c7
Opcode Fuzzy Hash: 1b4a32f99686ad8e8552b21601a9740773d8011b740ad22497235cd9a2c5f2a2
Instruction Fuzzy Hash: FBE197B5528340EFE3249F64E885B2EBBF9FB85345F54882CE68987251D731D824CF92

Function 00208590 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

), xrefs: 0020860C
IEND, xrefs: 002089F0
), xrefs: 00208616

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 2257e70c7dd029e778a93c06f4fb126a9c08702cec18c3ad7a6ba490a23e4cee
Instruction ID: 9012d509c3dc40d0a5a7fcde3d8ca3fbaeceeb0714378db77c3ac4042195cd19
Opcode Fuzzy Hash: 2257e70c7dd029e778a93c06f4fb126a9c08702cec18c3ad7a6ba490a23e4cee
Instruction Fuzzy Hash: 6DE1BFB1A187069FE310DF28C88572BBBE4BB94314F144A2DE595973C2DB75E924CBC2

Function 003DCA73 Relevance: 4.1, Strings: 2, Instructions: 1633COMMON

Download Yara Rule

Strings

:ikX, xrefs: 003DCCE1
/-ro, xrefs: 003DDD29

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: /-ro$:ikX
API String ID: 0-1410291922
Opcode ID: 4359737660235479101568899797a2b030654c803a258936ce8fd46d56438015
Instruction ID: eb91c48e3904f07bbc2c160fc095e7b0254a30d7829c1a7967b12f03ec02a40e
Opcode Fuzzy Hash: 4359737660235479101568899797a2b030654c803a258936ce8fd46d56438015
Instruction Fuzzy Hash: 1AB22AF3A0C2049FE7046E2DEC8567ABBE9EF94720F16853DEAC4C7744EA3558058693

Function 003D1065 Relevance: 4.0, Strings: 2, Instructions: 1547COMMON

Download Yara Rule

Strings

S{, xrefs: 003D114E
A}~, xrefs: 003D136E

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: S{$A}~
API String ID: 0-1114911465
Opcode ID: 4bf3ef25939764ed0174eea8cf0c66cbd685d3346e96e2ff7f2e8954db50fcc6
Instruction ID: 4fd7444c75d69595178124d7cb7a691d2f131e98cf8fced73960e5b5a2ef8a0c
Opcode Fuzzy Hash: 4bf3ef25939764ed0174eea8cf0c66cbd685d3346e96e2ff7f2e8954db50fcc6
Instruction Fuzzy Hash: 01B218F36082049FE3046E2DEC8567AFBE6EFD4720F1A493DEAC483744E63598158697

Function 003D7F97 Relevance: 3.5, Strings: 2, Instructions: 993COMMON

Download Yara Rule

Strings

IS, xrefs: 003D832D
s{+, xrefs: 003D8571

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: IS$s{+
API String ID: 0-456566559
Opcode ID: a37ff2892184497a850abcfaeab052d9091200a882f4654038669917e6fe82cb
Instruction ID: 7a3aae0c2412793c6b5869ad86f3cc01b88e5acf2413d12ed16e8d6b0e20f8fb
Opcode Fuzzy Hash: a37ff2892184497a850abcfaeab052d9091200a882f4654038669917e6fe82cb
Instruction Fuzzy Hash: 396208F360C2009FE3046E2DEC8577ABBE9EF94320F1A453DE6C5C7744EA7598058696

Function 00244040 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

f, xrefs: 0024420C
%*+(, xrefs: 002440A4, 002440AD

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: 5c75b011afaff02c3912125351913cb838557077956ebc884eba07af47555a09
Instruction ID: 08feb3c33401faae2ddd52f65e7303973aa2f226cb19ced7cda3479cbe10b927
Opcode Fuzzy Hash: 5c75b011afaff02c3912125351913cb838557077956ebc884eba07af47555a09
Instruction Fuzzy Hash: C812CE716183418FC718DF18C890B2EBBE5FBC9314F588A2CF4988B291D771E965CB92

Function 0023F620 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

dg, xrefs: 0023F7F5
hi, xrefs: 0023F6E6

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: dg$hi
API String ID: 0-2859417413
Opcode ID: bbd8d40914e2665416080874d725e234c26c094b12986bbe8356a4bdc85803a9
Instruction ID: cdc5597dbdc9aa405966a41bc95540ae8392d07fbff94f2d433dda3b974045ae
Opcode Fuzzy Hash: bbd8d40914e2665416080874d725e234c26c094b12986bbe8356a4bdc85803a9
Instruction Fuzzy Hash: E4F1A6B1628341EFE704CF24E895B2ABBF5FB86345F14892CF0958B2A1C734D854CB16

Function 002035B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

Inf, xrefs: 00203607
NaN, xrefs: 0020360E

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: 365c9db54e6073d1dad7907510aec95068df33541dbad9772b8eb00d10f3cb51
Instruction ID: d268e7b387c3626193b3421cfbe3570d796bd3bb98777b3cd75a695844c18bb2
Opcode Fuzzy Hash: 365c9db54e6073d1dad7907510aec95068df33541dbad9772b8eb00d10f3cb51
Instruction Fuzzy Hash: 2DD1E771B283129BC704CF28C88061EB7E9FBC8750F248A2DF999973D1E671DD148B82

Function 0021FFDF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BaBc, xrefs: 00220197
Ye[g, xrefs: 002200F6

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: 5d9ef4945cd540fd4200b5f7b8c648cdf482ebfafff74a21f2aa215f9bbc08bc
Instruction ID: 29b6f003b80b669c13c8a2928a4f446677e6bf2d952d918b1eac726f1c62a0f5
Opcode Fuzzy Hash: 5d9ef4945cd540fd4200b5f7b8c648cdf482ebfafff74a21f2aa215f9bbc08bc
Instruction Fuzzy Hash: 4B51EDB16283929BD331CF54D881BABB7E4FF96310F08491DE4C98B652E3749950CB57

Function 00205160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 002054C8

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 15b54b34a64a0a32a6337a54b09cfe87be00b98da9e8eb54b456b72c304132cb
Instruction ID: 90c2e445585c8d2631d6574fbf25523f4ffb4657afd8f4c8ed75dfd62ae8d68c
Opcode Fuzzy Hash: 15b54b34a64a0a32a6337a54b09cfe87be00b98da9e8eb54b456b72c304132cb
Instruction Fuzzy Hash: 2822C4B6928B628BE7158E18D840327FBA2AFE0304F19856DD8594B3D3E7B1DC64DF41

Function 002312D0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 002315D1

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: 50423f60663d3e31b6ca4da57adef2205819c81bc5df5854b3da12bb9020a5e1
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: 05F127B1A283424FD728CF28C49166BBBE5AFC5350F1CC56DE89987382D634DD25CB92

Function 0022AE57 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0022B2D3, 0022B2DB

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 003c5e90efd2291a8e4f63b3c29535c9a3a9c75846f57228fdd4b97db9b9bfb7
Instruction ID: a84e8e4c854f92a595e082199ab69f88e82d544bd98a502b05e2ae50a9fc3fbf
Opcode Fuzzy Hash: 003c5e90efd2291a8e4f63b3c29535c9a3a9c75846f57228fdd4b97db9b9bfb7
Instruction Fuzzy Hash: 0EE1BA71528316EBC315DF68E49066EB3F2FF98781F54891CE8C587260E335E969CB82

Function 00216EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00216EF3

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 5e8f1fba7acb469c9eeae9372941e55951273baae18bb69a5580d9ca1da97497
Instruction ID: 8efc3738ba8be6d2e47f56f0bc80991a832212b637ef710170afd3f628829c27
Opcode Fuzzy Hash: 5e8f1fba7acb469c9eeae9372941e55951273baae18bb69a5580d9ca1da97497
Instruction Fuzzy Hash: 14F191B5620701CFC724DF24E985A6AB3F6FF99314B148A2DD49787A91EB30F865CB40

Function 00227E60 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00228263, 0022826B

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 0bceb9c28933b01630912057c3dd0af943b9dabf6aab56f5033bb0706e8f5e21
Instruction ID: e5683a62f5f037b004e52f461721d3bf8c70a9aba26a6ff890bcca3a5deb168f
Opcode Fuzzy Hash: 0bceb9c28933b01630912057c3dd0af943b9dabf6aab56f5033bb0706e8f5e21
Instruction Fuzzy Hash: 43C1E1B1529321BBD710EF54E842A2BB7F5EF95314F484818F8C987292E734DD20CBA2

Function 00228D62 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00229233, 0022923B

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 41277e9dc90a43b4b5eb35ae563f712887f58e32f9cace0c6a0202226597ebc3
Instruction ID: b3069eeaa739b2ab804b5a7dfd0709a09f070a1b307c47c053cf00c422f8cce8
Opcode Fuzzy Hash: 41277e9dc90a43b4b5eb35ae563f712887f58e32f9cace0c6a0202226597ebc3
Instruction Fuzzy Hash: 3DD1E070629302DFD704DFA8EC94A2AB7F5FF88306F49486CE88687251D734E960CB55

Function 00214487 Relevance: 1.6, Strings: 1, Instructions: 389COMMON

Download Yara Rule

Strings

BI!, xrefs: 0021485E

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: BI!
API String ID: 0-3784139950
Opcode ID: cd45c87662f3dc15a0df930560322d8cfbf2f332f8d5a0756c069a5c2ff03cbe
Instruction ID: d665855c0226389ffac5d756457c2f241844797e3bf648df67fb0f45e7f34c44
Opcode Fuzzy Hash: cd45c87662f3dc15a0df930560322d8cfbf2f332f8d5a0756c069a5c2ff03cbe
Instruction Fuzzy Hash: 9DE110B5610B008FD361DF28E996B97B7E1FF0A708F04886DE4AAC7752D731B8608B54

Function 00247FC0 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 00248167

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 4269f5259f13486a2d55bf66143e7ff2d2965e68b7e264e5c2e2bedec6a26b2b
Instruction ID: d7a5d7c3983bc3bd1fe08d520619079199f2e2d72b5541651b0cfbaed30f7a08
Opcode Fuzzy Hash: 4269f5259f13486a2d55bf66143e7ff2d2965e68b7e264e5c2e2bedec6a26b2b
Instruction Fuzzy Hash: 61D1D5729282758FC729CE18D89071EB7E1EB85718F15862CE8B5AB380CB71DC56C7C1

Function 00246CBF Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

"p$, xrefs: 00247015

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: "p$
API String ID: 0-3618952891
Opcode ID: 998827149d17ebc889b9e19574c5bc9229384edb3ad579476d03d250c5b7afc4
Instruction ID: 8c2e12fa1ad692e18b3c49193a34fd7f0de7fb29010321478e41e706279948fe
Opcode Fuzzy Hash: 998827149d17ebc889b9e19574c5bc9229384edb3ad579476d03d250c5b7afc4
Instruction Fuzzy Hash: 49D1043661C351CFC715CF38E89452ABBE2BB8A356F094A6DE891C7391D330DA44CB95

Function 0022CCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0022CDC3, 0022CDCB

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: dd02a4f7bd7ceb30e0df4cd34c126ca88582ffe5cd2082e0f5a20a989bbd9a14
Instruction ID: 8e3cc8c3a74f9dc752b3904ffd13e04e17bb73dc3cc3bb5958d724d151c4ae42
Opcode Fuzzy Hash: dd02a4f7bd7ceb30e0df4cd34c126ca88582ffe5cd2082e0f5a20a989bbd9a14
Instruction Fuzzy Hash: 70B10270628312ABD714DF94E880B2FBBE6EF95340F24492CE5C58B352E335D965CB92

Function 0020A850 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

,, xrefs: 0020A9C3

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction ID: 6620bdec9e4f2c45d125b78c74c2a0257b782bd597ef5ca2a1bd1a9948a089ed
Opcode Fuzzy Hash: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction Fuzzy Hash: 97B128712083859FD324CF18C88061BBBE1AFA9704F448A2DF5D997382D671EA18CB57

Function 0023FC20 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0023FCA4, 0023FCAD

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 1276605f8e5c84afd36530e811f5465e5275f3ddae5b056f345fe1336e8b641d
Instruction ID: 501a30dae448c307eaf3cbe4f3f59da806a9ebba9ae0d136bbe7aa1e65b38042
Opcode Fuzzy Hash: 1276605f8e5c84afd36530e811f5465e5275f3ddae5b056f345fe1336e8b641d
Instruction Fuzzy Hash: CF81DFB1A28305EBD714DF54F988B2AB7E5FB99706F14882CF5C587292D730D824CB62

Function 0021D457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0021D663, 0021D66B

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 26f87cc59e244f902d0b826efc1ac2efdc59d5414aa3bebac3eddfa04d1e6662
Instruction ID: b12ece9303d0fc72163f481a822ffef9e30de11e4543e4983b962deda4e3a510
Opcode Fuzzy Hash: 26f87cc59e244f902d0b826efc1ac2efdc59d5414aa3bebac3eddfa04d1e6662
Instruction Fuzzy Hash: BD6104B1914315DBD710EF18EC82A6AB3F5FFA4354F44492CF98987292E731E960CB92

Function 00329388 Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

C_, xrefs: 0032956B

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: C_
API String ID: 0-3736261967
Opcode ID: 8c4f0fc315083c79ba33dc4bd34ff1948bb9d417ec93e42057db94631812afbf
Instruction ID: cde625acaafced6bb941dafb708c825082949b638119328b171c0eb3fcd36405
Opcode Fuzzy Hash: 8c4f0fc315083c79ba33dc4bd34ff1948bb9d417ec93e42057db94631812afbf
Instruction Fuzzy Hash: 7F614BF3A087049BE3046E2ADC4573BFBDAEBD4730F1A863DE6C493784EA7554058646

Function 00244A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00244C33, 00244C3B

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 929b23bac97bdbb89faa15a3f0fd51bd77bad1b021f2f1e9c77c6149973169aa
Instruction ID: 97aa8f76d37fa51ac75746240b0aa4de5a94dfd6de6ae77b1275469ef19e5696
Opcode Fuzzy Hash: 929b23bac97bdbb89faa15a3f0fd51bd77bad1b021f2f1e9c77c6149973169aa
Instruction Fuzzy Hash: B2612371A283029FD718EF15D880B2AF7E6EBC4319F18891DE5C587291C771EC20CB52

Function 0020E1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 0020E333

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: e63720651a896a22c37e8d7b77db7e7eee3ffc728a34b5ac8d3b0d9a3d059bf1
Instruction ID: e3dd4a286f443b742d7610d325fd8f1d40d9771eead16486e53894d2ea7960ac
Opcode Fuzzy Hash: e63720651a896a22c37e8d7b77db7e7eee3ffc728a34b5ac8d3b0d9a3d059bf1
Instruction Fuzzy Hash: 65515837B3A7904BD7288A3C5C55369AE870B93334B3FCBAAE9F18B3E6D55548514380

Function 00243920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 002439E3, 002439EB

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: ce7dd701e10c9695681f2414fe68a93af9bfae9c4a5fe6544226a4c2ae452c31
Instruction ID: 95badaaccd507b779a36d1968f0b23df476f855a99496530e754c2a15b843324
Opcode Fuzzy Hash: ce7dd701e10c9695681f2414fe68a93af9bfae9c4a5fe6544226a4c2ae452c31
Instruction Fuzzy Hash: 3151BF306283519BCB28DF14D894A2EFBE5FF89705F18881CE4C687251C371DE20CB62

Function 003776C9 Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

E<_{, xrefs: 0037773E

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: E<_{
API String ID: 0-1510703816
Opcode ID: be73df48af92c67dd62dd94f3d6c4ffc9f8eca256db860dde52eecd6cc2efee6
Instruction ID: 47bdcd8d5262960686f9f19e93548541e3ddbc18ce3240a9f94671c0bc798c54
Opcode Fuzzy Hash: be73df48af92c67dd62dd94f3d6c4ffc9f8eca256db860dde52eecd6cc2efee6
Instruction Fuzzy Hash: 355166F3A182145BF3046E69ED5137AB7EADB94320F2B493EDAC493744E979280187D2

Function 00211BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 00211C3E

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: f0998b58559170f0950b5d1b9290f3f085e024eb52d8146d1081746be5ceafb9
Instruction ID: 1a87382be569071ff21a28c4dd05d9331ed04908c0fb38898d28d48af15d625c
Opcode Fuzzy Hash: f0998b58559170f0950b5d1b9290f3f085e024eb52d8146d1081746be5ceafb9
Instruction Fuzzy Hash: BE4163B40183819BC7149F14D894A6FBBF0BF96314F04891DF6C59B290D736C965CB97

Function 002F57DC Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

e$), xrefs: 002F58FF

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: e$)
API String ID: 0-2024940801
Opcode ID: 71ddc82110959b77c6108545d1b99f23ed2e1c59e843832577e57b6be889b724
Instruction ID: ad5f4dfdc34d2a31c8ea2684065370acb5306e8353a51d8aef116a2fa66ffc33
Opcode Fuzzy Hash: 71ddc82110959b77c6108545d1b99f23ed2e1c59e843832577e57b6be889b724
Instruction Fuzzy Hash: 0C4149F3A082004BF7447E3CDD9832AB6D6AFD4310F1B463DEBC587784E97A58058686

Function 0023FF70 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00240033, 0024003B

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 1cf93bc85b3f8a26dd007d8114333137d41cf2d1b14961e082a1f521fde1cd8a
Instruction ID: c9bbaee35b47ce825cb273dc7941daa1f8d2900b90a22c6844a588443b173147
Opcode Fuzzy Hash: 1cf93bc85b3f8a26dd007d8114333137d41cf2d1b14961e082a1f521fde1cd8a
Instruction Fuzzy Hash: B831E7B1924311ABD714EE54EC81F2BB7E8EB85744F545828FA8587252E331DC64CB63

Function 0022E40C Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

72?1, xrefs: 0022E6A2

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 0132c321d7b5d6449ac7b0a9875e744223f9065587e8c5c410f3454ede216c5f
Instruction ID: e300e8d839f30fbe0bfd2a53e7a832320d09d9cac80860087407052e840b910f
Opcode Fuzzy Hash: 0132c321d7b5d6449ac7b0a9875e744223f9065587e8c5c410f3454ede216c5f
Instruction Fuzzy Hash: 5231D2B5A10315DFCB20CF95F8806AFF7B4FB1A305F140828E446A7341D331A924DBA2

Function 00216F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0021703B

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 5baa87f1bad569a38ff242d016f2cae0dfbc1b52f62e066b0c908d8f6004d2d2
Instruction ID: 1a81f12501df739b102220d0691a83e05b7db81f28da58f9f345daa8ceb13f28
Opcode Fuzzy Hash: 5baa87f1bad569a38ff242d016f2cae0dfbc1b52f62e066b0c908d8f6004d2d2
Instruction Fuzzy Hash: 74417775224B05DBD734CF61D994F26B7F2FB5D301F148818E98A8BAA1E331F8608B50

Function 0022E66A Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

72?1, xrefs: 0022E6A2

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: da6c2f559fe12a5d70e988adf74e78c6904f4bff8c505217865ff18572b606cb
Instruction ID: a43aee23b449a351010f105a0ce4b99bd415ba21512070fce6f51068ab530187
Opcode Fuzzy Hash: da6c2f559fe12a5d70e988adf74e78c6904f4bff8c505217865ff18572b606cb
Instruction Fuzzy Hash: E821D1B1A10315DFCB20CF95E89466FFBB5BB1A701F14081CE446AB341C331AD20DBA6

Function 00249CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00249D30

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: f379703ca1b725cdf28f548173cd47149a1a1168c3541528217290b1bdb7bb39
Instruction ID: 0c1589217c56e7dfd272db88bedfe3c940e71cc9a890e4e5685f3d3c1a3fa52e
Opcode Fuzzy Hash: f379703ca1b725cdf28f548173cd47149a1a1168c3541528217290b1bdb7bb39
Instruction Fuzzy Hash: 68317470918301DBD718EF18D880A2BFBF9EF9A318F14892CE6C897251D335D954CBA6

Function 00214E2A Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da29e5ef7dd8e4715073152b60f1a22e2b4f6a0ba5ef00dcd4f532bcb9fafff0
Instruction ID: 0be6306833f177daf20cdc925fd11b561bbd88e4b038b204980bcc7966d26b46
Opcode Fuzzy Hash: da29e5ef7dd8e4715073152b60f1a22e2b4f6a0ba5ef00dcd4f532bcb9fafff0
Instruction Fuzzy Hash: 71627BB4520B00DFD725CF24D980B67B7F6AFA9700F54896CD49A87A52E734F8A4CB90

Function 0020BEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction ID: 0640e629f5efc22f12abbd9757d6031f33bf0f3a57a406f1dbf319a54ec2ddc2
Opcode Fuzzy Hash: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction Fuzzy Hash: F652E6719287128BC7259F18D8402BAF3E1FFD4319F358B2DD986932D2D774A861CB86

Function 00248652 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de2ada3b83cb1ddc0bacaed4412713182908c2882c7b6cfd104aabc5135c996e
Instruction ID: b6dd0eb0418b2c8a460214553bf947b7aadea66e480f5c60ae2fa4ecb96df52e
Opcode Fuzzy Hash: de2ada3b83cb1ddc0bacaed4412713182908c2882c7b6cfd104aabc5135c996e
Instruction Fuzzy Hash: 3122CE35618341DFC708EF68E89462AF7E1FF8931AF09886DE98987351D731D9A0CB46

Function 002486F0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32c78f7394ddf92510114e154dd09f9d1f903231675fdc2cdf22be3f86a8719a
Instruction ID: b85ac39ebe1288178301c405d0d4e9e568f6e7875311d96723f67731155e1075
Opcode Fuzzy Hash: 32c78f7394ddf92510114e154dd09f9d1f903231675fdc2cdf22be3f86a8719a
Instruction Fuzzy Hash: FB22BC35618341DFD708EF68E89461EFBE1FB8930AF09896DE58987361C735D8A0CB46

Function 0020B3A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dcf79fc3f54fb11dbefe7eff03628b4d3cc2bf31e071a3931bb18bb43ef6226
Instruction ID: c28fef065e3284c5ad43a0db4412676e43f2d690384412fa709875c04675b678
Opcode Fuzzy Hash: 3dcf79fc3f54fb11dbefe7eff03628b4d3cc2bf31e071a3931bb18bb43ef6226
Instruction Fuzzy Hash: E452C270918B898FE736CF24C4847A7BBE2AB95314F144C6EC5E606BC3C779A894CB41

Function 002071F0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c9957a88077510d1eb82311e24f59dc57eb2bd9c8cf059e7f32b69042f2acf5
Instruction ID: 8c9c8e9040a26458ecf38fe280b64eee68d93ad6f4fc38b46ce5235ec0897f02
Opcode Fuzzy Hash: 2c9957a88077510d1eb82311e24f59dc57eb2bd9c8cf059e7f32b69042f2acf5
Instruction Fuzzy Hash: E552C43191C3468FCB15CF28C0906AABBE1FF88314F198A6DF89957392D774E959CB81

Function 00208FD0 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4d601d4dcfc4819f4cebc317fb170d19b78d4d06f06623ba3166dc9d06dd77
Instruction ID: d809349834224d7fc666f04684c3a5781894ee579e14199f5d67578f325a85de
Opcode Fuzzy Hash: 6b4d601d4dcfc4819f4cebc317fb170d19b78d4d06f06623ba3166dc9d06dd77
Instruction Fuzzy Hash: 92428B79618301DFEB04CF28E85476ABBE1BF89315F09886CE486873A2D375D995CF42

Function 00207BF0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ad5724a7b72f0ba0103e9ef3c5d1302b0ffe8b656daab158235912c9a4ee27
Instruction ID: 4ffffa390d1f44d500f579675362a457440a22f232250c840f92774aef91679f
Opcode Fuzzy Hash: 79ad5724a7b72f0ba0103e9ef3c5d1302b0ffe8b656daab158235912c9a4ee27
Instruction Fuzzy Hash: 9C322270924B118FC368CF29C590626BBF2BF85710B604A2ED6A787F92D776F855CB10

Function 002489A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3abc182aed2873737d46838e2a8fc0433d9fea16fea7ef518410c5f4c20e5b7
Instruction ID: d6deb5d262c4f7d93114c1110fee74d63907d629e4f742672e61d683ea14ff3a
Opcode Fuzzy Hash: a3abc182aed2873737d46838e2a8fc0433d9fea16fea7ef518410c5f4c20e5b7
Instruction Fuzzy Hash: C202BC30618341DFC704EF68E88461AFBE5EB8930AF09896DE58987361C335D9A0CB96

Function 00248A80 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5fbe9cf2505f95b79e6da7324fcefc5d3231727fd08a7d4c708b937bdabdefa
Instruction ID: 918084891f0afc5368b0779d7042dc9c7ab43573e563e884a1d804cb7aff937f
Opcode Fuzzy Hash: e5fbe9cf2505f95b79e6da7324fcefc5d3231727fd08a7d4c708b937bdabdefa
Instruction Fuzzy Hash: 48F19B3061C341DFC704EF28E88461EFBE5EB8A309F19896DE4C987261D336D960CB96

Function 00248C02 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9244b12c39d3dd7599209c56a7f8f2d6b57c757c37517d28127b8cdf5d4d877
Instruction ID: c9c934572022f161a556be1651797cfa10b6967ae191a4a44b324924a7a73ee3
Opcode Fuzzy Hash: c9244b12c39d3dd7599209c56a7f8f2d6b57c757c37517d28127b8cdf5d4d877
Instruction Fuzzy Hash: 7DE1C031618351DFC708EF28E88462AF7E5EB8931AF19896CE9C9C7361D735D950CB82

Function 0020A300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: 0c8b15098665de161b25f6b5f8a93612e21f49449e82d5f8e46d68ac8ef6426e
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: 6EF1AB766083418FC724CF29C88176BFBE6AFD8300F48892DE4D587792E639E955CB52

Function 00248E70 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be4c03755d668adc55f1b418e11467a0b6155dcffe72ac9fcc7e219c579a863a
Instruction ID: 2c9d7e58cf6fd6f8d3afb0f8a11c8aab7f6065951ab6237273d98d672cbc1b3c
Opcode Fuzzy Hash: be4c03755d668adc55f1b418e11467a0b6155dcffe72ac9fcc7e219c579a863a
Instruction Fuzzy Hash: A0D1AC3061C351DFD708EF28E88462EFBE5EB8A309F19896DE4C587261D736D860CB56

Function 00247AB0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1daf3ae00b8475e0ccbe22a97fa33de2d0b4c33b001e69cc32393f0533d81a
Instruction ID: e5148b6aef0d4ff46b55341715a43736738f81fc68418cc67b3c99f5651da4bb
Opcode Fuzzy Hash: ce1daf3ae00b8475e0ccbe22a97fa33de2d0b4c33b001e69cc32393f0533d81a
Instruction Fuzzy Hash: 09B10972A2C3514BE328DF28CC4576BB7E9EBC4314F444A2DE9A597382E735DC148B92

Function 0020AF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: f8dfc2f016a2405f91435e76872acb807c79d610fb5de09ad98101655978e677
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: 48C17AB2A187418FC370CF68DC96BABB7E1BF85318F08492DD1D9C6242E778A155CB46

Function 00216536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4b98c1f654f6678905a2994575fc3d5904eecaba169335d508b65eab5dbc99
Instruction ID: bc5d5362281c68825c7f66c55cceb1af4e6e74c68c4d6ebbfab92c5f0a56766b
Opcode Fuzzy Hash: db4b98c1f654f6678905a2994575fc3d5904eecaba169335d508b65eab5dbc99
Instruction Fuzzy Hash: 14B111B4610B408FC325CF24C984B5BBBF6EF56704F54885CE8AA8BA92E335F855CB54

Function 00247710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b1fd25086cc1f3b4fdec89fa51ecb686aa336f0f30892544f0d1ba8cb537b595
Instruction ID: 0cfdc3654aed32edb9a6ffd9d1ed152296e041468c8eca22a0862b54bf99bbf9
Opcode Fuzzy Hash: b1fd25086cc1f3b4fdec89fa51ecb686aa336f0f30892544f0d1ba8cb537b595
Instruction Fuzzy Hash: 7B918B71628311ABE728DF14D840B6BBBE5EB89354F544C1CF8A587392E730E960CB92

Function 0024A0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71dc861181ac9373c2a61b423c5b9abe52754e61706de7068b776bc538e15319
Instruction ID: dffba32daba32093f1175b8719b7e8462e028b7afa937c38976e1a88dc56e04a
Opcode Fuzzy Hash: 71dc861181ac9373c2a61b423c5b9abe52754e61706de7068b776bc538e15319
Instruction Fuzzy Hash: 578190342587028BD728DF28D890A2EB7F5FF49744F45896CE985CB251E771EC20CB92

Function 002364F0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93bc0a3f3d2af39d1341d27ba6f7afa36a276b63b566b8ccefdbed4c58a390dc
Instruction ID: 7038e4a89fde9d2dee741a7a46cf3ab05bb69d7f42c3852e03564b7de4f1acf9
Opcode Fuzzy Hash: 93bc0a3f3d2af39d1341d27ba6f7afa36a276b63b566b8ccefdbed4c58a390dc
Instruction Fuzzy Hash: 0771E677B39A904BC3149D3C9C8A3A5AA8B4BD7334F3DC379A9B48B3E5D6694C164340

Function 002228E9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 922a4b82d4db689288e757082a36882b8b641442aee8dee6afef73a2dcb00c3a
Instruction ID: e4a8fb7656af6ca34dd96e885fbd2c354c236aceeeb70f9feceb1263e6c806e4
Opcode Fuzzy Hash: 922a4b82d4db689288e757082a36882b8b641442aee8dee6afef73a2dcb00c3a
Instruction Fuzzy Hash: 5C618AB4428360EBD310AF54E851A2BB7F4EF96750F14491CE4C59B261E33AC924CB67

Function 00227C00 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630de8d289eef4e09d48a0d1cdc533b444bc78f6d340983bbaa205cf7e86eea9
Instruction ID: 18a9bf41598aee22da3df941caa1925785c872c241434f78891006224c4e9e6f
Opcode Fuzzy Hash: 630de8d289eef4e09d48a0d1cdc533b444bc78f6d340983bbaa205cf7e86eea9
Instruction Fuzzy Hash: 4C51FDB0628321ABDB209FA4DC82B7733B4EF86368F144558F9858B391F375E811C762

Function 00231860 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: 08d5cb4a47da3838d5e63d01db511b025894e00b31a8adfd038559c226cd44ac
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: 5261D0B16293029BD714CE28C58032FBBE6ABC9351F68C92DE4898B355D7B0DDB1D741

Function 002382D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b804aeade8876ab032fe0309d9355f3cbf5387573f07a93e53f3794f1dfaca75
Instruction ID: 74ccdbfb51f00552b139bd932fe9f034351598c15e06b8ce404726a1bce177cf
Opcode Fuzzy Hash: b804aeade8876ab032fe0309d9355f3cbf5387573f07a93e53f3794f1dfaca75
Instruction Fuzzy Hash: 20613867B7AB914BC315453C6C553A6AA831BD2730F3EC3A6F9B18F3E5CDA948124341

Function 002CFF6B Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edf2e2073b56c8f34372108cba8cfbca7f64371c929b3e4185e04084477faa15
Instruction ID: d2892552d2a41b11dddb04260f46a18ed59107d8d944f52371284cefe4e3423d
Opcode Fuzzy Hash: edf2e2073b56c8f34372108cba8cfbca7f64371c929b3e4185e04084477faa15
Instruction Fuzzy Hash: BF5118F3A082145FF308592DEC8577AB7D6DB80320F15823DEA89DBB88F9395D014286

Function 002142FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f35e1c34948cc957798fac8a0e3ecc555dbf5f790886cb04043c9ae83d02df
Instruction ID: ebb017c8b9bd739f4e00092d7134abf6a89dce32cc5caa8eb2c447c021be9bee
Opcode Fuzzy Hash: 97f35e1c34948cc957798fac8a0e3ecc555dbf5f790886cb04043c9ae83d02df
Instruction Fuzzy Hash: 8381C2B4811B00AFD360EF39D947797BEF4AB06301F404A1DE8EE96695E7306459CBE2

Function 0023E8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: 731921d7b46c2a07086207d2420bb087978b92491a081d8abb1ff3b66157cdf5
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: 1B516BB16087548FE714DF69D49435BBBE1BB89318F054E2DE4E987390E379DA088F82

Function 002B2E2A Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 170d3f2b12c87b9d41469065f10fdbb9b5ef9ec60d39d36e7c1c068191d95a45
Instruction ID: 2413a6713bd0b7ba4b29308e0b8b62a548c9e9e06f62104319acbe56b27395d7
Opcode Fuzzy Hash: 170d3f2b12c87b9d41469065f10fdbb9b5ef9ec60d39d36e7c1c068191d95a45
Instruction Fuzzy Hash: F95146F39183149FE714AE3DEC8577AB7E5EB84720F16463DDAC4C7380E935A8058686

Function 003A091D Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a1481d9c372a62b8fce1fdecc054e32193813f5aaa2679d52b8ee1ad1d571d
Instruction ID: 5fdf7e21482b5af0f010454df45d2209ac6be9e78ede54251cb648e5987578e5
Opcode Fuzzy Hash: f3a1481d9c372a62b8fce1fdecc054e32193813f5aaa2679d52b8ee1ad1d571d
Instruction Fuzzy Hash: 6B5112F3B046004BF3086E29DC85779F6D7ABE4325F1B463D8AC887785E97958068682

Function 00247520 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99ea9dda558ed79ca841901c0cb32558930eb0a85ce35c8f6765ccdd9545e25
Instruction ID: 0ece9dac6e9fd267e564b71145d937379af30c3fb003f2c50fd54ee3acbeb22c
Opcode Fuzzy Hash: e99ea9dda558ed79ca841901c0cb32558930eb0a85ce35c8f6765ccdd9545e25
Instruction Fuzzy Hash: 4751373162C3109BC7189E18DC90B2EF7E6FB89354F688A2CE8E557391C731EC208B91

Function 00205A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2937f3c42c18894b0ebce44bed175206f02c9d7687412b4ef0d23b8b2117536b
Instruction ID: e673a5de5e5de2ef016dccc4290a1968ec4b869c802f2f326a90ae5e63483a65
Opcode Fuzzy Hash: 2937f3c42c18894b0ebce44bed175206f02c9d7687412b4ef0d23b8b2117536b
Instruction Fuzzy Hash: 4351E2B1A147159FD714EF14C880927B7A0FF85328F15466CE8958B393D630EC62CF92

Function 002FBD27 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b187552a73fc78da5b705d140334a480b73cfeccb19211de287241ebc8a17201
Instruction ID: 86fd4bb96b615af3257f73c95f8c7388c0082d837f6d36dfa1fb497c9a9fd8da
Opcode Fuzzy Hash: b187552a73fc78da5b705d140334a480b73cfeccb19211de287241ebc8a17201
Instruction Fuzzy Hash: 1D4167F3E045108BE3186938EC1936BB696EB94320F1B463DD9C9C7784EA3998058685

Function 0022EC48 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adeeb7233b1a420663e33e0ec22b9b59a32313a5aa6c97b84269ed7341740309
Instruction ID: f6b800f52032aebf337400e0b9e5e7ec79b089ec290ef1b99bf15fce7130e5a5
Opcode Fuzzy Hash: adeeb7233b1a420663e33e0ec22b9b59a32313a5aa6c97b84269ed7341740309
Instruction Fuzzy Hash: 4441D474910326DBDF20CF94EC917ADB7B0FF09300F540548E945AB3A0DB389960DB91

Function 00249B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d33e247193f5e03dca461dbf790a0e79b589d0f3409a16101cdf6d88430721
Instruction ID: 639e07b32251682c06115dbec466dde97fbaffd0a1bf3c594dad01100a70b154
Opcode Fuzzy Hash: c3d33e247193f5e03dca461dbf790a0e79b589d0f3409a16101cdf6d88430721
Instruction Fuzzy Hash: BB419034218301ABD718DF14E9D4B2BF7E6EB89714F14882DF58997251D331E860CB66

Function 003095BE Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 199e6dfe5b939d2244f4e867b7178cf79cab7fe6a922d6292c9a79c7e90f1731
Instruction ID: 3260197e054ced919291912deee2efe4c42b8e9fa22f8ad11610ad3e0f1375e3
Opcode Fuzzy Hash: 199e6dfe5b939d2244f4e867b7178cf79cab7fe6a922d6292c9a79c7e90f1731
Instruction Fuzzy Hash: 0C4128F35085009FE308AE29DC9477EBBE9EB94324F1A853DE6C6C7744E53558058692

Function 00212030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d6a57222f1cd9a9aa6456ef2a612f1c171b54b1631685469a7c567e16a547eb
Instruction ID: cf469586fb4efe7ce2319659485df65d3e673ac4b9b0d17bb2caf0006795622d
Opcode Fuzzy Hash: 9d6a57222f1cd9a9aa6456ef2a612f1c171b54b1631685469a7c567e16a547eb
Instruction Fuzzy Hash: A1412A32A1C3654FD35CCF29849027ABBE1AFD8300F19862EF4D6873D1DAB48999D781

Function 00211E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66c1c4a56cdcba4a39ac492f9a964fbef93a2cc57ac6e35d27555d044ebf6ae8
Instruction ID: 9cdf9833c8fa422b3ee3f615e476bdc48f175829ea95cc140232e490ca1de9ee
Opcode Fuzzy Hash: 66c1c4a56cdcba4a39ac492f9a964fbef93a2cc57ac6e35d27555d044ebf6ae8
Instruction Fuzzy Hash: 24411F74118380ABC320AF58D888B1EFBF5FB96344F24091DF6C497292C376E8648F66

Function 00248D8A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa7e36d265bb12eef119c47ff6dd675bbdaa48d9a8fb1359354b818152cbadf2
Instruction ID: 704b36db5705e7c5c3916dda26ad96fd18bcce7cc946ac539569ae688f317d88
Opcode Fuzzy Hash: fa7e36d265bb12eef119c47ff6dd675bbdaa48d9a8fb1359354b818152cbadf2
Instruction Fuzzy Hash: 4C41E331A2D3518FC308EF68C49052EFBE6AF99700F098A1ED4D5D7291DB74DD118B82

Function 0021D961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f36746970824d66ace4955ac09a8e06093bba992796054494bf240b240c1c93
Instruction ID: 23070c919d0f0fc802e8709933c8575aad5fd96aea7e1b09d7e8f47d13570ebc
Opcode Fuzzy Hash: 0f36746970824d66ace4955ac09a8e06093bba992796054494bf240b240c1c93
Instruction Fuzzy Hash: E441A9B1658391CBD730DF14D885BABB7B0FFA6361F040958E88A8B692E7744890CB57

Function 0023F030 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: b67124eef5a478d5b804b16493b6dc12d72c0dd61125455cc76376eb32fa29f5
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: E2213732D182254BC3289F1DD68063BF7E8EB99704F06863EE8C4A7295E3359C2487E1

Function 002467EF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d69668b43d451048b5c62c65b9e147b285969dd9983756a9190898c8933007
Instruction ID: 73133883de3dee0db423b2eb35f59de578c33adc7916f3911c458b82b0644533
Opcode Fuzzy Hash: e7d69668b43d451048b5c62c65b9e147b285969dd9983756a9190898c8933007
Instruction Fuzzy Hash: 353135705183829AD718CF14C49462FBBF0AF96784F54580CF4C8AB261D334D999CB9A

Function 00225E70 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e49b999ff22a7299a23cabf509222ed669a5526539dc09ef772911ac16dceee
Instruction ID: 7ce71c6efd14f0c36e67572876a3e83eab24d5602efeb7a5903f9af582454905
Opcode Fuzzy Hash: 8e49b999ff22a7299a23cabf509222ed669a5526539dc09ef772911ac16dceee
Instruction Fuzzy Hash: 9C21A1B0528321ABC320AF58D94193BB7F4EF96765F558908F4D59B692E334C920CBA3

Function 002049A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction ID: 496f64f42b5e5a5f4c8313a548d7f95e6a2189d5fdd449249df45df462714afa
Opcode Fuzzy Hash: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction Fuzzy Hash: 1E31DBB17683019BD710AF58D89052BB7E1EF88358F18C53CE99A872C3D231EC62CB46

Function 002464B8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fbf1d62de77f803dbb47700336ecc8718e4deddada758ace366d5e106d3ccc9
Instruction ID: c6d4e79e64724b1d2e37840b14a9cbe121cd15c87c161fccb1905ed84fc2cd63
Opcode Fuzzy Hash: 9fbf1d62de77f803dbb47700336ecc8718e4deddada758ace366d5e106d3ccc9
Instruction Fuzzy Hash: 4E213B7062C241DBC718EF19E494A2EFBE5EB96745F18881CE4C593261C335A860CB67

Function 00210EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ee3bb64055169f48520c1f48ccd38ca6a09d2bf13309b1af8f37255d1809399
Instruction ID: d8ff1508bbc5dda63ae3782964c50d4e76056145dc8316a0b4d4cd6efc84c82a
Opcode Fuzzy Hash: 2ee3bb64055169f48520c1f48ccd38ca6a09d2bf13309b1af8f37255d1809399
Instruction Fuzzy Hash: EE2148B491021A9FDB14CF94CC90BBEBBB1FF4A304F144808E411BB292C775A951CF64

Function 00245700 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f68cbf680232f4daf1c8d425ae42e944068a0ccf2616477b312a8db6088f2d0
Instruction ID: 2aa6fa07295c690111551d9eae6644d6a00ea9c5a5b7cc48164b809e26e6d3b2
Opcode Fuzzy Hash: 9f68cbf680232f4daf1c8d425ae42e944068a0ccf2616477b312a8db6088f2d0
Instruction Fuzzy Hash: 86119E7192C650EBC305EF28E844A1BFBF9AF86711F05882CE4C49B212D335D820CBA6

Function 0023B650 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: f51f62b1e73a52c85e58ba82b42c8439247f996515082fb89d16682ad1aec5ba
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 7E11E573A251D90EC3178D3C8441565BFA71AE3234F598399F4B89B2D3D7228D8A8764

Function 00230B80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: e78ece4ea5f323890a85a2adcea40cda81d3fc4c8efa94731fdc4216a55d6c30
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: 550171F5B2030247E720DF5494E1B3BF2AA6F8071CF18452CE80657242DB75EC25CAB5

Function 0022D1E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e6033570f12d13a1335d5f84f232c4aaeb9ce31c2233ba0976f847479ed3051
Instruction ID: f2191d10465953d4df5cdc726d769242173e7be0daca61288858ee42d6f31177
Opcode Fuzzy Hash: 8e6033570f12d13a1335d5f84f232c4aaeb9ce31c2233ba0976f847479ed3051
Instruction Fuzzy Hash: 3511EFB0418380EFD3109F619494A1FFBE5EB96714F548C0DF5A49B251C375D825CF56

Function 00206EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8706f6d31cb388ad3a88795671e6153de3a0eb7c2fea29f25fc03bedc6967975
Instruction ID: 80f7e2fcf8a7fe3e31e2288f823751c4705d0a885f823efb21d9c901ee617b3e
Opcode Fuzzy Hash: 8706f6d31cb388ad3a88795671e6153de3a0eb7c2fea29f25fc03bedc6967975
Instruction Fuzzy Hash: F5F0243E72831B0FF311CDAAE8CC83BB396D7DA364B041539EA41C3642CD72E8228190

Function 0023B8C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 0021C5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 0021B410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: ffd3bae00a6b6551a09ad664cea9a44b7bc8c334b3e09727809dc8d5d520178c
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: 33F0ECB16145105BDF23CE549CD0FB7BBECCBAB354F190426F84557103D2615895C3E5

Function 00238220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aef9bf2f2ebcfcc40696bfa0ce766fb71281fec768f4ffb94a840eb88515d205
Instruction ID: b21319399a9fb61201100279e75328cc0300dd616626c69b72bb9803c3cfd48e
Opcode Fuzzy Hash: aef9bf2f2ebcfcc40696bfa0ce766fb71281fec768f4ffb94a840eb88515d205
Instruction Fuzzy Hash: E001E4B44107009FC360EF29C485747BBE8EB08714F104A1DE8AECB680D770A5548B82

Function 00241440 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 5f9fca28d04e2bd5ef431d2d0259cf40eb06f21147abb43159bced92cec65c56
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 61D0A731608322469F788E19E400977F7F0EAC7F11F49955EF686E3148D230DC91C2A9

Function 00211ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4e74f0251de8b681d8a303ba5fb837bd824fdd23301213edc3d2e2e55c7e9f1
Instruction ID: f8b0fde925d80f63c6d01f86c33a866cee793fffe02bf5ae51a507cb2274653b
Opcode Fuzzy Hash: a4e74f0251de8b681d8a303ba5fb837bd824fdd23301213edc3d2e2e55c7e9f1
Instruction Fuzzy Hash: 59C01238A681018B82849F00B999436B6B8A78730D700602ADB02E7221DAB0D4228909

Function 00246094 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902863b10545d7596fd5fa5b1c8866798d5aa1a8850d6f1a15bb5d9bc33044fc
Instruction ID: f1b399c1187972269c2406f7f07233e5f370923bc281512b89cad64f9e4c6665
Opcode Fuzzy Hash: 902863b10545d7596fd5fa5b1c8866798d5aa1a8850d6f1a15bb5d9bc33044fc
Instruction Fuzzy Hash: C4C09B3467C20087910CCF04F955475F3779BA776D724B01DC84723656D134D526951D

Function 00211A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa266d445d26fe197383c263e539f7b1559b94127872a145ef1420240f14167
Instruction ID: e3ed68432c5592410688d4d0a6ffddc9c63af1b7667f673dd81fc3c6396db737
Opcode Fuzzy Hash: 6aa266d445d26fe197383c263e539f7b1559b94127872a145ef1420240f14167
Instruction Fuzzy Hash: 73C04C29A690418A82848E85B995472A6E85757208710303A9702E7261D9A0D4258509

Function 00245FD6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108671395.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.2108638919.0000000000200000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000003F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000503000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108719151.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108930872.0000000000511000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109036228.00000000006B1000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e441cb935e6916c0a9b8fc8d13c8331383dca13650b48c9110c94987c972be6
Instruction ID: 3577cc30597e5c32b00c2d184a010fc1d0b77feb5b509d5145149679d93c8a7a
Opcode Fuzzy Hash: 3e441cb935e6916c0a9b8fc8d13c8331383dca13650b48c9110c94987c972be6
Instruction Fuzzy Hash: 21C09B2476820047924CCF14ED55535F2B79B9756D714B01DC80563255D134D511850C

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
file.exe

Function 0020FCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Function 0020D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Function 00245BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 0024695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Function 0021049B Relevance: .3, Instructions: 264
COMMON

Function 00210228 Relevance: .2, Instructions: 218
COMMON

Function 002499D0 Relevance: .1, Instructions: 143
COMMON

Function 00243220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 00243202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON